Synacor: >> Zimbra Collaboration Suite >> 7.2.7 Security Vulnerabilities
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
CVSS Score
6.1
EPSS Score
0.074
Published
2019-05-29
CVE-2019-9621
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
Known exploited
CVSS Score
7.5
EPSS Score
0.81
Published
2019-04-30
Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.
CVSS Score
5.3
EPSS Score
0.006
Published
2018-10-03
CVE-2018-6882
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
Known exploited
CVSS Score
6.1
EPSS Score
0.298
Published
2018-03-27
Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS.
CVSS Score
6.1
EPSS Score
0.01
Published
2018-02-04
Synacor Zimbra Collaboration Suite (ZCS) before 8.7.10 has Persistent XSS.
CVSS Score
5.4
EPSS Score
0.009
Published
2018-02-04
A service provided by Zimbra Collaboration Suite (ZCS) before 8.7.6 fails to require needed privileges before performing a few requested operations.
CVSS Score
9.8
EPSS Score
0.026
Published
2017-05-23
Directory traversal vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.7.6 allows attackers to have unspecified impact via unknown vectors.
CVSS Score
9.8
EPSS Score
0.038
Published
2017-05-23
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) before 8.7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score
6.1
EPSS Score
0.017
Published
2017-05-23
Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that (1) add, (2) modify, or (3) remove accounts by leveraging failure to use of a CSRF token and perform referer header checks, aka bugs 100885 and 100899.
CVSS Score
8.8
EPSS Score
0.014
Published
2017-05-17