CVE-2021-35208

CVE-2021-35208 affects Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23 (and 9.x before 9.0.0 Patch 16). The vulnerable component is ZmMailMsgView.js in the Calendar Invite feature, where HTML containing executable JavaScript placed in element attributes can be injected and rendered as arb...

CVE-2021-35208

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected...

CVE-2021-35209

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against...

CVE-2021-35209

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against...

CVE-2021-35209

The CVE-2021-35209 issue affects Zimbra Collaboration Suite via the ProxyServlet /proxy implementation. The X-Host header can override the Host header in proxied requests, and the value is not validated against zimbraProxyAllowedDomains, enabling an SSRF-like possibility and open redirect behavio...

CVE-2021-34807

An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any U...

CVE-2021-34807

An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any U...

CVE-2021-34807

CVE-2021-34807 affects Zimbra Collaboration Suite. A open redirect vulnerability exists in the /preauth Servlet through version 9.0. Exploitation requires a valid zimbra auth token or valid preauth token; with token data, an attacker could redirect a user to any URL using isredirect=1&redirectURL...

CVE-2021-35207: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode...

PT-2021-20840

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions 8.8.x through 8.8.15 Patch 22 Description: An issue was discovered in the Calendar Invite component, specifically in ZmMailMsgView.js. This issue allows an attacker to place HTML containing executable...

CVE-2021-35208: Improper Neutralization of Input During Web Page Generation

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected...

Zimbra Collaboration Suite 代码问题漏洞

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A code issue vulnerability exists in Zimbra Collaboration Suite versions prior to 8.8.15 Patch 23 and 9.0.0 Patch 16, which stems from the value o...

CVE-2021-35209: Server-Side Request Forgery (SSRF)

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against...

Zimbra Collaboration Suite跨站脚本漏洞

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A security vulnerability exists in versions prior to Zimbra Collaboration Suite 8.8.15 Patch 23, which can be exploited by an attacker to place HT...

PT-2021-20841

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions 8.8.0 through 8.8.15 Patch 22 Zimbra Collaboration Suite versions 9.0.0 through 9.0.0 Patch 15 Description: An issue was discovered in ProxyServlet.java in the /proxy servlet. The value of the X-Host header...

Zimbra Collaboration Suite跨站脚本漏洞

Zimbra Collaboration Suite ZCS is a collaboration software suite that includes an email server and web client. A cross-site scripting vulnerability exists in the login component of the web client for Zimbra Collaboration Suite. An attacker could exploit this vulnerability by adding executable...

Zimbra Collaboration Suite 输入验证错误漏洞

Zimbra Collaboration Suite ZCS is a collaboration software suite that includes an email server and web client. An open redirection vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite. An attacker obtaining a valid zimbra authentication token or a valid preauth token could...

PT-2021-20662

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions prior to 9.0 Description: An open redirect issue exists in the /preauth Servlet. To exploit this, an attacker needs a valid zimbra auth token or preauth token. With the token, an attacker can redirect a use...

CVE-2021-34807: URL Redirection to Untrusted Site

An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any U...

Insurance and Ransomware

As ransomware becomes more common, Im seeing more discussions about the ethics of paying the ransom. Heres one more contribution to that issue: a research paper that the insurance industry is hurting more than its helping. However, the most pressing challenge currently facing the industry is...