8 matches found
Unspecified Vulnerability in Zimbra zm-mailbox
Zimbra zm-mailbox is a mailbox management tool from the American company Zimbra. A security vulnerability in the cs/service/account/AutoCompleteGal.java file in versions of Zimbra zm-mailbox prior to 8.8.15.p8 can be exploited by an attacker to request an arbitrary GAL account...
CVE-2020-10194
cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request...
CVE-2020-10194
cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request...
CVE-2020-10194
cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request...
CVE-2020-10194
CVE-2020-10194 affects Zimbra zm-mailbox prior to 8.8.15.p8. The flaw is in cs/service/account/AutoCompleteGal.java, where authenticated users can request any GAL account due to domain-matching checks not behaving as intended. Connected sources (including Red Hat and CNVD variants) corroborate th...
CVE-2020-10194
cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request...
PT-2020-11967
Name of the Vulnerable Software and Affected Versions Zimbra zm-mailbox versions prior to 8.8.15.p8 Description The issue allows authenticated users to request any GAL account, differing from the intended behavior where the domain of the authenticated user must match the domain of the galsync...
CVE-2020-10194: Missing Authorization
cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request...