Zimbra Collaboration Suite cross-site scripting vulnerability

Versions of Zimbra Collaboration Suite prior to 10.1.17 contain a cross-site scripting vulnerability. This flaw arises because the /h/rest document editor in Classic Web Client inserts script attributes without properly encoding package names within the packages parameter, resulting in reflected...

Zimbra Collaboration Suite authorization issue vulnerability

Versions 10.1.16 and 10.1.20 of the Zimbra Collaboration Suite contain an authorization issue vulnerability. This vulnerability stems from a lack of explicit authorization; unauthenticated administrators can override global Zimlet configurations via ConfigureZimletRequest. By adding domains...