CVE-2018-15131

An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests...

CVE-2018-15131

CVE-2018-15131 affects Synacor Zimbra Collaboration Suite: versions 8.6.x prior to 8.6.0 Patch 11, 8.7.x prior to 8.7.11 Patch 6, 8.8.x prior to 8.8.8 Patch 9, and 8.8.9 prior to 8.8.9 Patch 3. are vulnerable to account number enumeration due to inconsistent responses for certain authentication r...

CVE-2018-15131: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests...

PT-2019-7174

Name of the Vulnerable Software and Affected Versions Synacor Zimbra Collaboration Server versions prior to 8.7.0 Description The issue is related to Reflected XSS in the admin console. Recommendations For versions prior to 8.7.0, update to version 8.7.0 or later to resolve the issue...

PT-2019-9091

Name of the Vulnerable Software and Affected Versions Synacor Zimbra Collaboration Suite versions 8.6.x through 8.6.0 Patch 10 Synacor Zimbra Collaboration Suite versions 8.7.x through 8.7.11 Patch 5 Synacor Zimbra Collaboration Suite versions 8.8.x through 8.8.8 Patch 8 Synacor Zimbra...

PT-2019-9024

Name of the Vulnerable Software and Affected Versions Synacor Zimbra Collaboration Suite ZCS Zimbra Web Client ZWC versions 8.8.8 through 8.8.8 before Patch 7 Synacor Zimbra Collaboration Suite ZCS Zimbra Web Client ZWC versions 8.8.9 through 8.8.9 before Patch 1 Description The issue is related ...

PT-2019-8774

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions prior to 8.8.0 beta 2 Description The issue is related to a Persistent XSS vulnerability via mail addresses in the Synacor Zimbra Admin UI. Recommendations For versions prior to 8.8.0 beta 2, update to versi...

CVE-2015-2230: Improper Neutralization of Input During Web Page Generation

Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console...

CVE-2018-10948: Improper Neutralization of Input During Web Page Generation

Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs...

CVE-2018-14425: Improper Neutralization of Input During Web Page Generation

There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite ZCS Zimbra Web Client ZWC 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1...

CVE-2019-9670

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...

CVE-2018-18631

mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...

CVE-2019-6981

Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component...

CVE-2018-20160

ZxChat aka ZeXtras Chat, as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd...

CVE-2018-18631

mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...

CVE-2019-9670

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...

CVE-2019-6980

Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component...

Deserialization of untrusted data

Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component...

Design/Logic Flaw

ZxChat aka ZeXtras Chat, as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd...

Xxe

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...