Synacor: >> Zimbra Collaboration Suite Security Vulnerabilities
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.
CVSS Score
6.1
EPSS Score
0.01
Published
2019-05-29
ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.
CVSS Score
9.8
EPSS Score
0.022
Published
2019-05-29
Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.
CVSS Score
9.8
EPSS Score
0.038
Published
2019-05-29
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.
CVSS Score
6.5
EPSS Score
0.012
Published
2019-05-29
CVE-2019-9670
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
Known exploited
CVSS Score
9.8
EPSS Score
1.0
Published
2019-05-29
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
CVSS Score
6.1
EPSS Score
0.074
Published
2019-05-29
CVE-2019-9621
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
Known exploited
CVSS Score
7.5
EPSS Score
0.81
Published
2019-04-30
Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.
CVSS Score
5.3
EPSS Score
0.006
Published
2018-10-03
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.
CVSS Score
8.8
EPSS Score
0.012
Published
2018-05-30
Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.
CVSS Score
6.1
EPSS Score
0.014
Published
2018-05-30