5383 matches found
CVE-2022-37042
Zimbra Collaboration Suite ZCS 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication i.e., not having an authtoken, an attacker can upload arbitrary files to the system, leading to directory traversal and remote code...
CVE-2019-11318
Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS...
CVE-2020-7796
Zimbra Collaboration Suite ZCS before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled...
CVE-2020-12339
Insufficient control flow management in the API for the IntelR Collaboration Suite for WebRTC before version 4.3.1 may allow an authenticated user to potentially enable escalation of privilege via network access...
CVE-2023-29044
Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now get...
CVE-2021-41101
wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS Access-Control-Allow-Origin header set by nginz is set for all subdomains of .wire.com including wire.com. This means that if somebody were to find an XSS vector in any of the...
CVE-2022-27924
Zimbra Collaboration aka ZCS 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries...
CVE-2019-12427
Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console...
Cyber Threat Exposure Management: A 5-Step Guide
Attackers don’t care about your long list of CVEs. They look for the path of least resistance to your most valuable assets. So, why are we still managing security from a defender’s checklist instead of an attacker’s playbook? A modern security program needs to see the entire attack surface throug...
CVE-2025-66376
Zimbra Collaboration ZCS 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets CSS @import directives in an HTML e-mail message...
CVE-2025-66376
Zimbra Collaboration ZCS 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets CSS @import directives in an HTML e-mail message...
CVE-2025-66376
Zimbra Collaboration ZCS 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets CSS @import directives in an HTML e-mail message...
Zimbra Collaboration 跨站脚本漏洞
Zimbra Collaboration is an open source enterprise email and collaboration platform from Zimbra that supports email, calendaring, document management, and team collaboration features. A cross-site scripting vulnerability exists in Zimbra Collaboration versions prior to 10.0.18 and prior to 10.1.13...
EUVD-2026-0850
Zimbra Collaboration ZCS 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets CSS @import directives in an HTML e-mail message...
PT-2026-1290
Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions prior to 10.0.18 Zimbra Collaboration Suite versions prior to 10.1.13 Description A stored cross-site scripting XSS flaw exists in the Classic UI of the software. The issue occurs when the HTML sanitizer fai...
CVE-2025-66376
CVE-2025-66376 affects Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13. The issue is a stored cross-site scripting (XSS) in the Classic UI caused by CSS @import directives in HTML emails. Impact is described as stored XSS in the Classic UI; no exploit details are provided bey...
CVE-2025-66376
Zimbra Collaboration ZCS 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets CSS @import directives in an HTML e-mail message...
CVE-2025-66376: Improper Neutralization of Input During Web Page Generation
Zimbra Collaboration ZCS 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets CSS @import directives in an HTML e-mail message...
📄 Zimbra Collaboration 10.0 / 10.1 Local File Inclusion
This is a proof of concept exploiting a local file inclusion vulnerability existing in the Webmail Classic UI of Zimbra Collaboration ZCS versions 10.0 and 10.1. The issue is due to improper handling of user-supplied request parameters in the RestFilter servlet. zimbramail-CVE-2025-68645-poc A...
