Show filters
7 Total Results
Displaying 1-7 of 7
Sort by:
Attacker Value
Very High
CVE-2022-37393
Disclosure Date: August 16, 2022 (last updated October 08, 2023)
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
3
Attacker Value
High
Zimbra Collaboration Suite ProxyServlet SSRF
Disclosure Date: April 30, 2019 (last updated October 06, 2023)
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
0
Attacker Value
Unknown
CVE-2019-6981
Disclosure Date: May 29, 2019 (last updated November 27, 2024)
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.
0
Attacker Value
Unknown
CVE-2018-18631
Disclosure Date: May 29, 2019 (last updated November 27, 2024)
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.
0
Attacker Value
Unknown
CVE-2019-6980
Disclosure Date: May 29, 2019 (last updated November 27, 2024)
Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.
0
Attacker Value
Unknown
CVE-2018-20160
Disclosure Date: May 29, 2019 (last updated November 27, 2024)
ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.
0
Attacker Value
Unknown
CVE-2018-14013
Disclosure Date: May 29, 2019 (last updated November 27, 2024)
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
0
