CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 02/07/2021 |
| CVE-2020-35123 | MEDIUM6.5 | In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17. | 17/12/2020 |
| CVE-2020-11737 | MEDIUM6.1 | A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring (including the quotes) followed immediately by a DO | 05/05/2020 |
| CVE-2020-10194 | MEDIUM6.5 | cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request. | 20/03/2020 |
| CVE-2013-1938 | MEDIUM6.1 | Zimbra 2013 has XSS in aspell.php | 12/02/2020 |
| CVE-2019-8947 | MEDIUM6.1 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS. | 27/01/2020 |
| CVE-2019-8946 | MEDIUM6.1 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. | 27/01/2020 |
| CVE-2019-8945 | MEDIUM6.1 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. | 27/01/2020 |
| CVE-2019-15313 | MEDIUM6.1 | In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability. | 27/01/2020 |
| CVE-2019-12427 | MEDIUM4.8 | Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console. | 27/01/2020 |
| CVE-2018-10939 | MEDIUM6.1 | Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group. | 30/05/2018 |
| CVE-2015-7610 | HIGH8.8 | Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token. | 30/05/2018 |
| CVE-2016-5721 | MEDIUM6.1 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 29/08/2016 |
| CVE-2015-6541 | HIGH8.8 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to service/soap/BatchRequest. | 08/04/2016 |
| CVE-2013-7217 | CRITICAL10.0 | Unspecified vulnerability in Zimbra Collaboration Server 7.2.5 and earlier, and 8.0.x through 8.0.5, has "critical" impact and unspecified vectors, a different vulnerability than CVE-2013-7091. | 26/12/2013 |
| CVE-2008-1226 | MEDIUM4.3 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration Suite (ZCS) 4.0.3, 4.5.6, and possibly other versions before 4.5.10 allow remote attackers to inject arbitrary web script or HTML via an e-mail attachment, possibly involving a (1) .jpg or (2) .gif image attachment. | 10/03/2008 |