zimbra collaboration vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote malicious user to escalate privileges and obtain sensitive information via the password and 2FA parameters.

Zimbra Collaboration 9.0.0 Zimbra Collaboration 8.8.15

9.8

CVSSv3

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an malicious user to execute arbitrary code via the sfdc_preauth.jsp component.

Zimbra Collaboration 9.0.0 Zimbra Collaboration 8.8.15

9.8

CVSSv3

An issue exists in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over...

Zimbra Collaboration 9.0.0 Zimbra Collaboration 8.8.15

1 Metasploit module4 Github repositories1 Article

9.8

CVSSv3

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal a...

Zimbra Collaboration 9.0.0 Zimbra Collaboration 8.8.15

10 Github repositories1 Article

9.8

CVSSv3

Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the syslog port). NOTE: a third party reports that this cannot be reproduced.

Zimbra Collaboration 8.8.15

9.8

CVSSv3

An issue exists in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 prior to 8.8.15 Patch 23 and 9.x prior to 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not che...

Zimbra Collaboration Zimbra Collaboration 8.8.15 Zimbra Collaboration 9.0.0

9.8

CVSSv3

Zimbra Collaboration Suite (ZCS) prior to 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

Synacor Zimbra Collaboration Suite Synacor Zimbra Collaboration Suite 8.8.15

9.8

CVSSv3

Synacor Zimbra Collaboration prior to 8.0.9 allows plaintext command injection during STARTTLS.

Synacor Zimbra Collaboration Server

9.8

CVSSv3

ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.

Synacor Zimbra Collaboration Suite 8.8.10 Synacor Zimbra Collaboration Suite 8.8.9 Synacor Zimbra Collaboration Suite Synacor Zimbra Collaboration Suite 8.7.11 Synacor Zimbra Collaboration Suite 8.8.11

9.8

CVSSv3

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x prior to 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.

Synacor Zimbra Collaboration Suite 8.7.11 Synacor Zimbra Collaboration Suite

1 EDB exploit7 Github repositories

Get Started

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook