zimbra collaboration server 8.8.15 vulnerabilities and exploits

(subscribe to this query)

In Zimbra Collaboration prior to 8.8.15 Patch 1, there is a non-persistent XSS vulnerability.

Zimbra Collaboration Server Zimbra Collaboration Server 8.8.15

In Zimbra Collaboration Suite up to and including 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM arguments, leading to local privilege escalation (LPE).

Zimbra Collaboration 9.0.0 Zimbra Collaboration 8.8.15

An issue exists in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over...

Zimbra Collaboration 9.0.0 Zimbra Collaboration 8.8.15

1 Metasploit module4 Github repositories1 Article

Zimbra Collaboration prior to 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console.

Zimbra Collaboration Server

RARLAB UnRAR prior to 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

2 Metasploit modules4 Github repositories1 Article

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

1 Metasploit module1 Article

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook