Synacor Zimbra Collaboration prior to 8.0.9 allows plaintext command injection during STARTTLS.
synacor zimbra collaboration server