Latest zimbra collaboration Vulnerabilities

● CVE-2023-43103
An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4 via an unsanitized parameter. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36.
Zimbra Collaboration<8.8.15
Zimbra Collaboration>=10.0.0<10.0.4
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
and 67 more
● CVE-2023-41106
An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3. An attacker can gain access to a Zimbra account. This is also fixed in 9.0.0 Patch 35 and 8.8.15 Patch 42.
Zimbra Collaboration<8.8.15
Zimbra Collaboration>=10.0.0<10.0.3
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
and 65 more
● CVE-2023-43102
An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4. An XSS issue can be exploited to access the mailbox of an authenticated user. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch...
Zimbra Collaboration<8.8.15
Zimbra Collaboration>=10.0.0<10.0.4
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
and 67 more
● CVE-2023-34193
File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function.
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
Zimbra Collaboration=8.8.15-p13
and 31 more
● CVE-2023-34192
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
Zimbra Collaboration=8.8.15-p13
and 31 more
● CVE-2023-29381
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
Zimbra Collaboration=8.8.15-p13
and 60 more
● CVE-2023-29382
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component.
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
Zimbra Collaboration=8.8.15-p13
and 60 more
● CVE-2023-24032
In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM arguments, leading to loc...
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
Zimbra Collaboration=8.8.15-p13
and 54 more
● CVE-2023-24031
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary JavaScript code, leading to information dis...
Zimbra Collaboration=9.0.0
Zimbra Collaboration=9.0.0-p0
Zimbra Collaboration=9.0.0-p1
Zimbra Collaboration=9.0.0-p10
Zimbra Collaboration=9.0.0-p11
Zimbra Collaboration=9.0.0-p12
and 17 more
● CVE-2023-24030
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra...
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
Zimbra Collaboration=8.8.15-p13
and 52 more
● CVE-2022-45913
An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via one of attributes in webmail URLs to execute arbitrary JavaScript code, leading to information disclosure.
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
Zimbra Collaboration=8.8.15-p13
and 57 more
● CVE-2022-45911
An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs int...
Zimbra Collaboration=9.0.0
Zimbra Collaboration=9.0.0-p0
Zimbra Collaboration=9.0.0-p1
Zimbra Collaboration=9.0.0-p10
Zimbra Collaboration=9.0.0-p11
Zimbra Collaboration=9.0.0-p12
and 22 more
● CVE-2022-45912
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An authenticated admin user can upload file...
Zimbra Collaboration=8.8.15
Zimbra Collaboration=9.0.0
● CVE-2022-41350
In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the vi...
Zimbra Collaboration=8.8.15
● CVE-2022-41349
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine...
Zimbra Collaboration=8.8.15
● CVE-2022-41351
In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value of the uncheck parameter to a string (ins...
Zimbra Collaboration=8.8.15
● CVE-2022-41348
An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure.
Zimbra Collaboration=9.0.0
● CVE-2022-41347
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As par...
Zimbra Collaboration=8.8.15
Zimbra Collaboration=9.0.0
● CVE-2022-41352
Zimbra Collaboration (ZCS) Arbitrary File Upload Vulnerability
Zimbra Collaboration=8.8.15
Zimbra Collaboration=9.0.0
● CVE-2022-37393
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuratio...
Zimbra Collaboration=8.7.6
Zimbra Collaboration=8.7.7
Zimbra Collaboration=8.7.9
Zimbra Collaboration=8.7.10
Zimbra Collaboration=8.7.11
Zimbra Collaboration=8.7.11-p1
and 57 more
● CVE-2022-37044
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing ...
Zimbra Collaboration=8.8.15
● CVE-2022-37042
Zimbra Collaboration (ZCS) Authentication Bypass Vulnerability
Zimbra Collaboration=8.8.15
Zimbra Collaboration=9.0.0
● CVE-2022-32294
** DISPUTED ** Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the...
Zimbra Collaboration=8.8.15
=8.8.15
● CVE-2022-27925
Zimbra Collaboration (ZCS) Arbitrary File Upload Vulnerability
Zimbra Collaboration=8.8.15
Zimbra Collaboration=9.0.0
● CVE-2022-27926
Zimbra Collaboration (ZCS) Cross-Site Scripting (XSS) Vulnerability
Zimbra Collaboration=9.0.0
Zimbra Collaboration (ZCS)
Roundcube email server=1.4.14
Roundcube email server=1.5.x before 1.5.4
Roundcube email server=1.6.x before 1.6.3
● CVE-2022-27924
Zimbra Collaboration (ZCS) Command Injection Vulnerability
Zimbra Collaboration=8.8.15
Zimbra Collaboration=9.0.0
● CVE-2022-24682
Zimbra Webmail Cross-Site Scripting Vulnerability
Zimbra Collaboration>=8.8<8.8.15
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
and 27 more
● CVE-2021-35208
Zimbra Collaboration>=8.8<8.8.15
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
and 18 more
● CVE-2021-35209
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the...
Zimbra Collaboration>=8.8<8.8.15
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
and 28 more
● CVE-2021-35207
An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an att...
Zimbra Collaboration>=8.8<8.8.15
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
and 34 more
● CVE-2021-34807
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token...
Zimbra Collaboration<8.8.15
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
and 34 more
● CVE-2020-35123
In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has ...
Zimbra Collaboration>8.8.0<8.8.15
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
and 22 more

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203