Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
zimbra collaboration suite vulnerabilities and exploits
(subscribe to this query)
7.8
CVSSv3
CVE-2023-24032
In Zimbra Collaboration Suite up to and including 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM arguments, leading to local privilege escalation (LPE).
Zimbra Collaboration 9.0.0
Zimbra Collaboration 8.8.15
9.8
CVSSv3
CVE-2022-37042
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal a...
Zimbra Collaboration 9.0.0
Zimbra Collaboration 8.8.15
11 Github repositories
1 Article
7.5
CVSSv3
CVE-2022-37041
An issue exists in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The value of X-Forwarded-Host header is not checked against the whi...
Zimbra Collaboration 9.0.0
Zimbra Collaboration 8.8.15
1 Github repository
5.7
CVSSv3
CVE-2022-37043
An issue exists in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views an attacker-controlled page, a request will be sent to the application that ...
Zimbra Collaboration 9.0.0
Zimbra Collaboration 8.8.15
6.1
CVSSv3
CVE-2023-24030
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite up to and including 9.0 and 8.8.15. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an...
Zimbra Collaboration 9.0.0
Zimbra Collaboration 8.8.15
6.1
CVSSv3
CVE-2022-41349
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine.
Zimbra Collaboration 8.8.15
6.1
CVSSv3
CVE-2022-41350
In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine.
Zimbra Collaboration 8.8.15
6.1
CVSSv3
CVE-2022-37044
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine.
Zimbra Collaboration 8.8.15
1 Github repository
6.1
CVSSv3
CVE-2022-41351
In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value of the uncheck parameter to a string (instead of default value of 10).
Zimbra Collaboration 8.8.15
NA
CVE-2012-1213
Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration Suite (ZCS) 6.x prior to 6.0.15 and 7.x prior to 7.1.3 allows remote malicious users to inject arbitrary web script or HTML via the view parameter.
Zimbra Zimbra
1 EDB exploit
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
bypass
open redirect
CVE-2024-4358
CVE-2024-24199
CVE-2024-5550
CVE-2024-5305
CVE-2024-30373
CVE-2024-1800
deserialization
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
2
3
4
5
6
7
8
NEXT »