5364 matches found
Design/Logic Flaw
ZxChat aka ZeXtras Chat, as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd...
Xxe
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...
CVE-2018-14013
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients...
CVE-2018-18631
CVE-2018-18631 : The Red Hat/NVD records confirm a Persistent Cross-Site Scripting (XSS) flaw in the mailboxd component of Zimbra Collaboration Suite. Affected products/versions include ZCS 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2. The available documents do not provide explo...
CVE-2018-18631
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...
CVE-2018-14013
Synacor Zimbra Collaboration Suite (versions before 8.8.11 ) is vulnerable to Reflected Cross-Site Scripting (XSS) in the AJAX and HTML web clients . The root cause involves improper neutralization of input during web page generation, allowing remote attackers to inject arbitrary JavaScript into ...
CVE-2019-6981
CVE-2019-6981 affects Zimbra Collaboration Suite 8.7.x through 8.8.11 and is described as a Blind SSRF vulnerability in the Feed component. Public sources in the provided documents confirm the issue exists in the specified product range, with no details on exploit vectors beyond SSRF and no patch...
CVE-2018-20160
CVE-2018-20160 affects ZxChat (ZeXtras Chat) used in Synacor Zimbra Collaboration Suite 8.7/8.8 and related products. The connected sources confirm an XXE attack vector triggered by a crafted XML request to mailboxd as the root cause. Concrete exploit details, affected versions beyond 8.7/8.8, or...
CVE-2018-20160
ZxChat aka ZeXtras Chat, as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd...
CVE-2019-6980
Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component...
CVE-2019-6980
CVE-2019-6980 affects Synacor Zimbra Collaboration Suite (Zimbra Collaboration Server) 8.7.x through 8.8.11, with insecure object deserialization in the IMAP component as the root cause. The issue is evidenced across multiple feeds (NVD/Nessus/Red Hat) and is rated high/critical (CVSS v3.0: 9.8; ...
CVE-2019-9670
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...
CVE-2019-9670
CVE-2019-9670 affects Synacor Zimbra Collaboration Suite (mailboxd) prior to 8.7.11p10, where Autodiscover/Autodiscover.xml processing is vulnerable to XML External Entity (XXE) injection. The root cause is XXE-safe processing not being enforced during XML parsing, enabling an attacker to retriev...
CVE-2019-9670
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...
PT-2019-18394
Name of the Vulnerable Software and Affected Versions Synacor Zimbra Collaboration Suite versions 8.7.x through 8.8.11 Description The issue concerns insecure object deserialization in the IMAP component. Recommendations For versions 8.7.x through 8.8.11, update to a version that includes a fix f...
CVE-2019-9670: Improper Restriction of XML External Entity Reference
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...
CVE-2018-18631: Improper Neutralization of Input During Web Page Generation
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...
CVE-2019-6981: Server-Side Request Forgery (SSRF)
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component...
CVE-2018-20160: Improper Restriction of XML External Entity Reference
ZxChat aka ZeXtras Chat, as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd...