CVE-2023-37580

Zimbra Collaboration ZCS 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client...

CVE-2023-38750

CVE-2023-38750 affects Zimbra Collaboration (ZCS) versions 8.x up to 8.8.15 Patch 41, 9.x up to 9.0.0 Patch 34, and 10.x up to 10.0.2, where internal JSP/XML files can be exposed (information disclosure). The vulnerability is linked to exposure of internal JSP and XML files and has been described...

CVE-2023-37580

CVE-2023-37580 – Zimbra Collaboration Suite (ZCS) XSS : The Nuclei template confirms a Cross-Site Scripting vulnerability in ZCS 8.x before 8.8.15 Patch 41, specifically in the Zimbra Classic Web Client. Impact described in the connected doc: successful exploitation could execute arbitrary script...

Zimbra issues awaited patch for actively exploited vulnerability

Two weeks ago, we urged readers to apply a workaround for an actively exploited vulnerability in Zimbra Collaboration Suite ZCS email servers. Zimbra has released ZCS 10.0.2 that fixes two security issues, including the known bug that could lead to exposure of internal JSP and XML files. Zimbra i...

PT-2023-4007

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions 8 through 8.8.15 Patch 40 Description Cross-Site Scripting XSS exists in the Zimbra Classic Web Client due to the failure of the autoSaveDraft function to properly neutralize special elements. A remote attacke...

Cross site scripting

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function...

Unrestricted file upload

File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function...

CVE-2023-34193

File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function...

CVE-2023-34192

CVE-2023-34192 affects Zimbra Collaboration Suite (ZCS) v8.8.15. A cross-site scripting (XSS) vulnerability exists in the /h/autoSaveDraft function that an authenticated remote attacker can exploit by sending a crafted script, allowing arbitrary script execution in the victim’s browser and potent...

CVE-2023-34193

CVE-2023-34193 affects Zimbra ZCS 8.8.15 where an authenticated privileged user can upload via the ClientUploader function, enabling arbitrary code execution and access to sensitive data. Root cause is a file-upload pathway vulnerability in Zimbra ZCS; impact includes high confidentiality, integr...

PT-2023-24729 · Zimbra · Zimbra Zcs

Name of the Vulnerable Software and Affected Versions: Zimbra ZCS version 8.8.15 Description: The issue allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function. Recommendations: For Zimbra ZCS version 8.8.15, consider...

CVE-2023-34193

File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function...

CVE-2023-29382

CVE-2023-29382 affects Zimbra Collaboration ZCS versions 8.8.15 and 9.0, where the vulnerable component is the JSP page sfdc_preauth.jsp . The issue enables an attacker to execute arbitrary code, as described in the CVE entry. The published metric indicates a CRITICAL impact (CVSS v3.1: 9.8, NETW...

CVE-2023-34193

File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function...

CVE-2023-34192

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function...

CVE-2023-29381

The CVE-2023-29381 entry concerns Zimbra Collaboration (ZCS) versions 8.8.15 and 9.0, where a remote attacker can escalate privileges and disclose sensitive information via the password and 2FA parameters. Multiple connected sources (Red Hat, PT-Security, and related CVE aggregates) confirm the a...

CVE-2023-34192

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function...

CVE-2023-24031

Zimbra Collaboration (ZCS) versions 8.8.15 through 9.0 are affected by an XSS vulnerability in the webmail /h/ endpoint. The root cause is inadequate protection of the web page structure, allowing an attacker to inject JavaScript and cause information disclosure. A practical workaround is to disa...

Vulnerabilities fixed in Zimbra Collaboration Suite

Zimbra has fixed vulnerabilities in the Zimbra Collaboration Suite ZCS. A malicious party can exploit the vulnerabilities to perform attacks that could result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Bypassing authentication Bypassing security measure...

CVE-2022-45913

Zimbra Collaboration (ZCS) 9.0 is affected by a Cross‑Site Scripting (XSS) issue in attributes of webmail URLs that can lead to information disclosure. The vulnerability is associated with ZCS 9.0 and is addressed by updates in Zimbra 9.0.0 patch 28 (and in 8.8.15 patch 35 for older branches). No...