CVE-2026-50056

A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite ZCS allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty...

CVE-2026-50056

A local privilege escalation vulnerability exists in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.21. The root cause is an argument injection flaw where the passwordless sudo interface accepts unrestricted JVM arguments. An attacker with local command e...

CVE-2026-50056 Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection

A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite ZCS allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty...

Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection Detection

Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML external entity injection XXE vulnerability via the mailboxd component. !/usr/bin/env python3 -- coding: utf-8 -- """Synacor Zimbra Collaboration Suite 8.""" import re from kittysploit import from lib.protocols.http.httpclient...

CVE-2018-18631

mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...

EUVD-2018-10347

Malware in sbrugna...

EUVD-2018-3003

Malware in sbrugna...

Zimbra Collaboration Suite XXE

The vulnerability of the mailboxd component Autodiscover/Autodiscover.xml in the Zimbra Collaboration Suite enterprise email management system is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to execute an XXE atta...

VulnCheck KEV: CVE-2019-9670

Synacor Zimbra Collaboration Suite ZCS contains an improper restriction of XML external entity XXE vulnerability in the mailboxd component...

Zimbra Collaboration Server 8.7.x < 8.7.11p10 XML External Entity injection (XXE) vulnerability

Mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability. Note that Nessus does not identify patch level or components versions for the Synacor Zimbra Collaboration Suite. You will need to verify if the patch has been...

CVE-2019-9670

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...

CVE-2019-9670

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...

CVE-2018-18631

mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...

Cross site scripting

mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...

CVE-2018-18631

CVE-2018-18631 : The Red Hat/NVD records confirm a Persistent Cross-Site Scripting (XSS) flaw in the mailboxd component of Zimbra Collaboration Suite. Affected products/versions include ZCS 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2. The available documents do not provide explo...

CVE-2019-9670

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...

PT-2019-10007

Name of the Vulnerable Software and Affected Versions: ZxChat aka ZeXtras Chat versions 8.7 through 8.8 Description: The issue allows XXE XML External Entity attacks. This can be demonstrated by sending a crafted XML request to the mailboxd endpoint. Recommendations: For versions 8.7 through 8.8,...

CVE-2018-18631: Improper Neutralization of Input During Web Page Generation

mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...

CVE-2019-9670: Improper Restriction of XML External Entity Reference

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection XXE vulnerability, as demonstrated by Autodiscover/Autodiscover.xml...

PT-2019-9612

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 8.6, 8.7 through 8.7.11 Patch 6, and 8.8 through 8.8.10 Patch 1 Description The issue is related to a Persistent XSS in the mailboxd component. Recommendations For versions 8.6, update to version 8.7.11 Patc...