Show filters
4 Total Results
Displaying 1-4 of 4
Sort by:
Attacker Value
Very High
CVE-2022-37393
Disclosure Date: August 16, 2022 (last updated October 08, 2023)
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
3
Attacker Value
Unknown
CVE-2018-10948
Disclosure Date: May 30, 2019 (last updated November 27, 2024)
Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
0
Attacker Value
Unknown
CVE-2018-6882
Disclosure Date: March 27, 2018 (last updated January 28, 2025)
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
0
Attacker Value
Unknown
CVE-2017-8802
Disclosure Date: January 16, 2018 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality.
0
