CVE-2023-45207

CVE-2023-45207 concerns Zimbra Collaboration Suite (ZCS) versions 8.8.15, 9.0, and 10.0. An attacker could send a PDF with embedded JavaScript via email; when the PDF is previewed in webmail (Chrome), a stored XSS payload may execute. Documents consistently state that this has been mitigated by s...

CVE-2023-45206

An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting XSS. Adding an adequate message to avoid malicious code will mitigate this issue...

Synacor Zimbra Security Vulnerability

Synacor Zimbra is an open source email collaboration platform from Synacor Inc. in the United States. A security vulnerability exists in Synacor Zimbra Collaboration ZCS versions 8.8.15, 9.0, and 10.0. An attacker can exploit the vulnerability to inject JavaScript or HTML code...

PT-2024-13613

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions 8.8.15 through 10.0 Description An issue was discovered in Zimbra Collaboration, where XSS, with resultant session stealing, can occur via JavaScript code in a link within an email message. This happens when a...

CVE-2023-48432

An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link for a webmail redirection endpoint within en email message, e.g., if a victim clicks on that link within Zimbra webmail...

CVE-2023-48432

An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link for a webmail redirection endpoint within en email message, e.g., if a victim clicks on that link within Zimbra webmail...

CVE-2023-50808

Zimbra Collaboration versions prior to Kepler 9.0.0 Patch 38 GA are vulnerable to DOM-based JavaScript injection within the Modern UI . This vulnerability allows an attacker to inject scripts, potentially leading to malicious script execution. To remediate this issue, users should update to Keple...

CVE-2023-45207: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. This has been mitigated by sanitising th...

PT-2024-13227 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 8.8.15 through 10.0 Description: An issue was discovered in Zimbra Collaboration, where an attacker can inject JavaScript or HTML code through the help document endpoint in webmail, leading to cross-site...

Synacor Zimbra Security Vulnerability

Synacor Zimbra is an open source email collaboration platform from Synacor, Inc. A security vulnerability exists in Synacor Zimbra Collaboration ZCS version 8.8.15, 9.0, which stems from a closed account with 2FA and a generated password that can send emails when configured as Imap/smtp...

CVE-2023-26562

In Zimbra Collaboration ZCS 8.8.15 and 9.0, a closed account with 2FA and generated passwords can send e-mail messages when configured for Imap/smtp...

CVE-2023-45207

An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. This has been mitigated by sanitising th...

CVE-2023-45207

An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. This has been mitigated by sanitising th...

CVE-2023-48432

An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link for a webmail redirection endpoint within en email message, e.g., if a victim clicks on that link within Zimbra webmail...

CVE-2023-50808

Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI...

CVE-2023-45206

An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting XSS. Adding an adequate message to avoid malicious code will mitigate this issue...

Zimbra Collaboration Suite Security Vulnerability

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Zimbra in the United States. The product includes WebMail, Calendar, Address Book and more. A security vulnerability exists in Zimbra Collaboration Suite versions 8.8.15, 9.0, and 10.0. An attacker exploited the vulnerabili...

PT-2024-13974 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration versions prior to Kepler 9.0.0 Patch 38 GA Description: The issue allows DOM-based JavaScript injection in the Modern UI. This could potentially lead to malicious script execution. No information is provided about the...

CVE-2023-45206: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting XSS. Adding an adequate message to avoid malicious code will mitigate this issue...

CVE-2023-50808: Improper Neutralization of Input During Web Page Generation

Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI...