5394 matches found
CVE-2018-15131: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests...
CVE-2019-6980
Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component...
CVE-2018-20160
ZxChat aka ZeXtras Chat, as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd...
CVE-2018-18631
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...
CVE-2019-9670
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...
CVE-2019-9670
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...
CVE-2019-6981
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component...
CVE-2018-18631
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...
Design/Logic Flaw
ZxChat aka ZeXtras Chat, as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd...
Xxe
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...
CVE-2018-14013
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients...
Deserialization of untrusted data
Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component...
Cross site scripting
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...
CVE-2018-18631
CVE-2018-18631 : The Red Hat/NVD records confirm a Persistent Cross-Site Scripting (XSS) flaw in the mailboxd component of Zimbra Collaboration Suite. Affected products/versions include ZCS 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2. The available documents do not provide explo...
CVE-2018-18631
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...
CVE-2018-14013
Synacor Zimbra Collaboration Suite (versions before 8.8.11 ) is vulnerable to Reflected Cross-Site Scripting (XSS) in the AJAX and HTML web clients . The root cause involves improper neutralization of input during web page generation, allowing remote attackers to inject arbitrary JavaScript into ...
CVE-2019-6981
CVE-2019-6981 affects Zimbra Collaboration Suite 8.7.x through 8.8.11 and is described as a Blind SSRF vulnerability in the Feed component. Public sources in the provided documents confirm the issue exists in the specified product range, with no details on exploit vectors beyond SSRF and no patch...
CVE-2018-20160
ZxChat aka ZeXtras Chat, as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd...
CVE-2018-20160
CVE-2018-20160 affects ZxChat (ZeXtras Chat) used in Synacor Zimbra Collaboration Suite 8.7/8.8 and related products. The connected sources confirm an XXE attack vector triggered by a crafted XML request to mailboxd as the root cause. Concrete exploit details, affected versions beyond 8.7/8.8, or...