CVE-2024-45519

CVE-2024-45519 is a remote command execution vulnerability in Zimbra Collaboration’s postjournal service. Unauthenticated attackers can resp. trigger code execution via crafted SMTP input, potentially gaining full control of affected Zimbra servers. Affected versions include 8.8.15 Patch 46 and e...

CVE-2024-45519

The postjournal service in Zimbra Collaboration ZCS before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands. Recent assessments: ccondon-r7 at October 02, 2024 7:58pm UTC reported: This is one of a list o...

VulnCheck KEV: CVE-2024-45519

Synacor Zimbra Collaboration Suite ZCS contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands...

PT-2024-31672 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions prior to 10.1.1 Description: A stored Cross-Site Scripting XSS issue exists in the "/modern/contacts/print" endpoint of Zimbra webmail. This allows an attacker to inject and execute arbitrary JavaScript code ...

PT-2024-31673 · Zimbra · Zimbra Collaboration +2

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions prior to 10.1.1 Description: A Cross-Site Scripting XSS issue exists due to insufficient sanitization of the packages parameter in one of the endpoints of Zimbra Webmail. This allows attackers to bypass...

PT-2024-31477 · Zimbra · Zimbra Administration Panel +2

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 9.0 through 10.0 Description: A vulnerability in the Webmail Modern UI of Zimbra Collaboration allows execution of stored Cross-Site Scripting XSS payloads. An attacker with administrative access to the Zimbr...

PT-2024-8655 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions through 10.1 Description: A reflected Cross-Site Scripting XSS issue exists in the Briefcase module due to improper sanitization of file content by the OnlyOffice formatter. This occurs when the victim opens ...

PT-2024-31676 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions through 10.1 Description: A Cross-Site Scripting XSS issue in the "/h/rest" endpoint of the Zimbra webmail and admin panel interfaces allows attackers to execute arbitrary JavaScript in the victim's session...

PT-2024-31675 · Zimbra · Zimbra Daffodil

Name of the Vulnerable Software and Affected Versions: Zimbra Daffodil version 10.1.1 Description: A Cross-Site Scripting issue has been identified. Recommendations: For Zimbra Daffodil version 10.1.1, apply the patch release to resolve the issue...

PT-2024-31671 · Zimbra · Zimbra Collaboration +2

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions through 10.0 Description: A stored Cross-Site Scripting XSS attack is possible due to improper sanitization of user input in Zimbra Webmail Modern UI. This allows an attacker to inject malicious code into...

The vulnerability of the Postjournal Service in the corporate email management system Zimbra Collaboration Suite allows a perpetrator to execute arbitrary commands.

The vulnerability of the Postjournal Service in the corporate email management system Zimbra Collaboration Suite is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute...

The vulnerability of the Zimbra Collaboration Suite’s email management system, which stems from insufficient validation of incoming requests, allows attackers to carry out SRF attacks.

The vulnerability of the Zimbra Collaboration Suite’s email management system is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to carry out a SRF attack remotely...

PT-2024-6328

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions prior to 8.8.15 Patch 46 Zimbra Collaboration Suite versions prior to 9.0.0 Patch 41 Zimbra Collaboration Suite versions prior to 10.0.9 Zimbra Collaboration Suite versions prior to 10.1.1 Description The...

PT-2024-31674 · Zimbra · Zimbra Daffodil

Name of the Vulnerable Software and Affected Versions: Zimbra Daffodil version 10.1.1 Description: A Cross-Site Scripting XSS issue was resolved due to inadequate validation of metadata's Content-Type when importing files into the briefcase. Recommendations: For Zimbra Daffodil version 10.1.1,...

PT-2024-6227 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 10.1.x through 10.1.0 Zimbra Collaboration ZCS versions 10.0.x through 10.0.8 Zimbra Collaboration ZCS 9.0.0 before Patch 41 Zimbra Collaboration ZCS 8.8.15 before Patch 46 Description: An issue in Zimbra...

PT-2024-10389 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite ZCS versions through 10.1 Description: The issue exists due to inadequate protection of the web page structure in the Briefcase Module of the Zimbra Collaboration Suite ZCS. An attacker can exploit this by creating ...

The vulnerability in the administration interface of the Zimbra Collaboration Suite email management system allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the administration interface of the Zimbra Collaboration Suite email management system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code by sending a...

Exploit for Path Traversal in Synacor Zimbra_Collaboration_Suite

CVE-2022-27925 Description On May 10, 2022, Zimbra released...

CVE-2024-27442

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of...

CVE-2024-33536

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading...