Design/Logic Flaw

An issue was discovered in Zimbra Collaboration ZCS before 10.0.3. An attacker can gain access to a Zimbra account. This is also fixed in 9.0.0 Patch 35 and 8.8.15 Patch 42...

CVE-2023-43103

An XSS issue was discovered in a web endpoint in Zimbra Collaboration ZCS before 10.0.4 via an unsanitized parameter. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36...

CVE-2023-41106

An issue was discovered in Zimbra Collaboration ZCS before 10.0.3. An attacker can gain access to a Zimbra account. This is also fixed in 9.0.0 Patch 35 and 8.8.15 Patch 42...

Zimbra Collaboration Suite Cross-Site Scripting Vulnerability

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Zimbra in the United States. The product includes WebMail, Calendar, Address Book and more. A cross-site scripting vulnerability exists in Zimbra Collaboration Suite ZCS versions prior to 10.0.3, prior to 8.8.15 Patch 43, a...

CVE-2023-43102

An issue was discovered in Zimbra Collaboration ZCS before 10.0.4. An XSS issue can be exploited to access the mailbox of an authenticated user. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36...

Zimbra Collaboration Suite Cross-Site Scripting Vulnerability

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Zimbra in the United States. The product includes WebMail, Calendar, Address Book and more. A cross-site scripting vulnerability exists in Zimbra Collaboration Suite ZCS versions prior to 10.0.3, prior to 8.8.15 Patch 43, a...

CVE-2023-43102

CVE-2023-43102 affects Zimbra Collaboration (ZCS) before 10.0.4. An XSS flaw could be exploited to access the mailbox of an authenticated user. This is fixed in ZCS 8.8.15 Patch 43 and 9.0.0 Patch 36 ; remediation is to upgrade to 10.0.4+ or apply the corresponding patches.

CVE-2023-41106

CVE-2023-41106 affects Zimbra Collaboration (ZCS) prior to 10.0.3. An unauthenticated attacker could gain access to a Zimbra account. The issue is fixed in 10.0.3 and also in 9.0.0 Patch 35 and 8.8.15 Patch 42. Remediation is to upgrade to a fixed release (10.0.3+ or corresponding patched lines)....

CVE-2023-43102

An issue was discovered in Zimbra Collaboration ZCS before 10.0.4. An XSS issue can be exploited to access the mailbox of an authenticated user. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36...

Zimbra Collaboration Suite Security Vulnerability

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Zimbra in the United States. The product includes WebMail, Calendar, Address Book and more. A security vulnerability exists in Zimbra Collaboration Suite ZCS versions prior to 10.0.3 that originates from a vulnerability tha...

CVE-2023-43103

Summary of CVE-2023-43103 (Zimbra Collaboration) Affects Zimbra Collaboration (ZCS) web endpoint. The vulnerability is a cross-site scripting (XSS) flaw caused by an unsanitized parameter in the web interface. Reported as present in ZCS versions prior to 10.0.4, with fixes applied in versions 8.8...

CVE-2023-41106

An issue was discovered in Zimbra Collaboration ZCS before 10.0.3. An attacker can gain access to a Zimbra account. This is also fixed in 9.0.0 Patch 35 and 8.8.15 Patch 42...

CVE-2023-43103

An XSS issue was discovered in a web endpoint in Zimbra Collaboration ZCS before 10.0.4 via an unsanitized parameter. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36...

PT-2023-28698 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions prior to 10.0.4 Zimbra Collaboration ZCS versions 8.8.15 before Patch 43 Zimbra Collaboration ZCS versions 9.0.0 before Patch 36 Description: An issue was discovered in Zimbra Collaboration, allowing an XSS...

Unpacking the Zimbra Cross-Site Scripting Vulnerability (CVE-2023-37580)

Insights and Protections On November 16, 2023, a significant security concern was published by Google's Threat Analysis Group TAG. They revealed an alarming vulnerability in Zimbra Collaboration, a widely-used email hosting tool for organizations. This vulnerability, designated with an identifier...

Email Security Flaw Found in the Wild

Googles Threat Analysis Group announced a zero-day against the Zimbra Collaboration email server that has been used against governments around the world. TAG has observed four different groups exploiting the same bug to steal email data, user credentials, and authentication tokens. Most of this...

Attacks, Vulnerabilities and Actors 13 November to 19 November 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries in the realm of cybersecurity threats. In the past week alone, a total of nine attacks were executed, twelve vulnerabilities were uncovered, and four active adversaries we...

Four Threat Actors Capitalized on Zimbra Zero Day to Infiltrate Government Organizations

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A zero-day vulnerability identified as CVE-2023-37580 in Zimbra Collaboration email software has been exploited by four different groups in attacks. These attacks aimed to illicitly obtain email data, us...

Zero-Day Flaw in Zimbra Email Software Exploited by Four Hacker Groups

A zero-day flaw in the Zimbra Collaboration email software was exploited by four different groups in real-world attacks to pilfer email data, user credentials, and authentication tokens. "Most of this activity occurred after the initial fix became public on GitHub," Google Threat Analysis Group T...

VulnCheck KEV: CVE-2013-7091

Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. dot dot in the skin parameter. NOTE: this can be leveraged to execute arbitrary code by...