4464 matches found
Exploit for Path Traversal in Synacor Zimbra_Collaboration_Suite
CVE-2022-27925 Setup git clone https://github.com/miko...
Unknown Attackers exploit several vulnerabilities in Zimbra Collaboration Suite
Threat Level Attack Report For a detailed advisory, download the pdf file here Summary The Zimbra Collaboration Suite ZCS email servers experienced multiple breaches between July and early August 2022. The exploitation of CVE-2022-27925, a remote-code-execution RCE vulnerability in ZCS, was most...
The vulnerability of the mboximport function in the Zimbra Collaboration Suite email management system allows a hacker to execute arbitrary code.
The vulnerability of the mboximport function in the Zimbra Collaboration Suite email management system is related to authentication deficiencies. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
Active Exploitation of Multiple Vulnerabilities in Zimbra Collaboration Suite
Over the past few weeks, five different vulnerabilities affecting Zimbra Collaboration Suite have come to our attention, one of which is unpatched, and four of which are being actively and widely exploited in the wild by well-organized threat actors. We urge organizations who use Zimbra to patch ...
PT-2022-4416 · Zimbra · Zimbra Collaboration Suite
Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite affected versions not specified Description: The issue is related to the sudo configuration in Zimbra, which allows the zimbra user to execute the zmslapd binary as root with arbitrary parameters. The zmslapd binary...
Threat Actors Exploiting Multiple Vulnerabilities Against Zimbra Collaboration Suite
CISA and the Multi-State Information Sharing & Analysis Center MS-ISAC have released a joint Cybersecurity Advisory CSA in response to active exploitation of multiple vulnerabilities against Zimbra Collaboration Suite ZCS, an enterprise cloud-hosted collaboration software and email platform. CISA...
Zimbra Collaboration Directory Traversal (CVE-2022-27925; CVE-2022-37042)
A Directory Traversal vulnerability exists in Zimbra Collaboration. Successful exploitation of this vulnerability could allow a remote attacker to disclose or access arbitrary files on the vulnerable server...
Arbitrary File Download Vulnerability in Huatian Power Collaboration Office System
Dalian Huatian Software Co., Ltd. is an OA software and solution provider. An arbitrary file download vulnerability exists in Huatian Power Collaboration Office System, which can be exploited by attackers to obtain sensitive information...
Exploit for Path Traversal in Synacor Zimbra_Collaboration_Suite
CVE-20...
CVE-2022-37043
An issue was discovered in the webmail component in Zimbra Collaboration Suite ZCS 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views an attacker-controlled page, a request will be sent to the application that appears to ...
CVE-2022-37042
Zimbra Collaboration Suite ZCS 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication i.e., not having an authtoken, an attacker can upload arbitrary files to the system, leading to directory traversal and remote code...
CVE-2022-37044
In Zimbra Collaboration Suite ZCS 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine...
CVE-2022-37041
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite ZCS 8.8.15 and 9.0. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The value of X-Forwarded-Host header is not checked against the whitelist of...
Directory traversal
Zimbra Collaboration Suite ZCS 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication i.e., not having an authtoken, an attacker can upload arbitrary files to the system, leading to directory traversal and remote code...
Design/Logic Flaw
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite ZCS 8.8.15 and 9.0. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The value of X-Forwarded-Host header is not checked against the whitelist of...
Design/Logic Flaw
In Zimbra Collaboration Suite ZCS 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine...
Cross site request forgery (csrf)
An issue was discovered in the webmail component in Zimbra Collaboration Suite ZCS 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views an attacker-controlled page, a request will be sent to the application that appears to ...
Zimbra Collaboration Suite 跨站请求伪造漏洞
Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A cross-site request forgery vulnerability exists in Zimbra Collaboration Suite ZCS version 8.8.15, 9.0, which stems from a cross-site request...
Zimbra Collaboration Suite 路径遍历漏洞
Zimbra Collaboration Suite ZCS is an open source collaboration suite from Zimbra in the United States. The product includes WebMail, Calendar, Address Book and more. A path traversal vulnerability exists in Zimbra Collaboration Suite version 8.8.15, 9.0. An attacker can exploit this vulnerability...
Zimbra Collaboration Suite 代码问题漏洞
Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A code issue vulnerability exists in Zimbra Collaboration Suite ZCS version 8.8.15, 9.0, which stems from the value of the X-Forwarded-Host header...