CVE-2024-27442

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of...

CVE-2024-33536

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading...

CVE-2024-33535

CVE-2024-33535 affects Zimbra Collaboration (ZCS) 9.0 and 10.0 via unauthenticated local file inclusion (LFI) in a web application, specifically in how the packages parameter is handled. The flaw allows an attacker to include arbitrary local files without authentication within a restricted direct...

CVE-2024-27443

CVE-2024-27443 affects Zimbra Collaboration (ZCS) 9.0 and 10.0, with a cross-site scripting flaw in the CalendarInvite feature caused by improper input validation of the calendar header. An attacker can embed a payload in a crafted calendar header sent via email; when a recipient views the messag...

CVE-2024-27443

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

Zimbra Collaboration Server security vulnerabilities

Zimbra Collaboration Server ZCS is an email and collaboration solution from Zimbra. The solution provides email, contacts, calendar, file sharing, social networking, and other features. A security vulnerability exists in Zimbra Collaboration Server versions 9.0 and 10.0, which stems from the...

Zimbra Collaboration Suite security vulnerabilities

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Zimbra. The product includes WebMail, Calendar, Address Book and more. A security vulnerability exists in Zimbra Collaboration Suite versions 9.0 and 10.0, which stems from mishandling of input parameters, and could allow a...

CVE-2024-33533

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting XSS vulnerability has been identified in the Zimbra webmail admin interface. This vulnerability occurs due to inadequate input validation of the packages parameter, allowing an...

CVE-2024-33536

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading...

CVE-2024-33533

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting XSS vulnerability has been identified in the Zimbra webmail admin interface. This vulnerability occurs due to inadequate input validation of the packages parameter, allowing an...

CVE-2024-33533

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting XSS vulnerability has been identified in the Zimbra webmail admin interface. This vulnerability occurs due to inadequate input validation of the packages parameter, allowing an...

CVE-2024-27442

Zimbra Collaboration (ZCS) 9.0 and 10.0 are affected by CVE-2024-27442. The zmmailboxdmgr binary, intended to run as the zimbra user with root privileges for specific mailbox operations, can be abused to escalate privileges from zimbra to root due to improper handling of input arguments, enabling...

CVE-2024-33536: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading...

CVE-2024-33533: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting XSS vulnerability has been identified in the Zimbra webmail admin interface. This vulnerability occurs due to inadequate input validation of the packages parameter, allowing an...

CVE-2024-27442: Improper Handling of Exceptional Conditions

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of...

CVE-2024-33535: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion LFI in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without...

CVE-2024-27443: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

CVE-2024-33535

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion LFI in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without...

Zimbra Collaboration Server security vulnerabilities

Zimbra Collaboration Server ZCS is an email and collaboration solution from Zimbra. The solution provides email, contacts, calendar, file sharing, social networking, and other features. A security vulnerability exists in Zimbra Collaboration Server versions 9.0 and 10.0 that stems from the presen...

CVE-2024-33535

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion LFI in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without...