CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 26/09/2022 |
| CVE-2022-37042KEV | 严重9.8 | Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this iss | 12/08/2022 |
| CVE-2022-27926KEV | 中危6.1 | A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters. | 21/04/2022 |
| CVE-2022-27925KEV | 高危7.2 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal. | 21/04/2022 |
| CVE-2022-27924KEV | 高危7.5 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries. | 21/04/2022 |
| CVE-2022-24682KEV | 中危6.1 | An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to b | 09/02/2022 |
| CVE-2020-18985 | 中危6.1 | An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing. | 15/12/2021 |
| CVE-2020-18984 | 中危6.1 | A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection. | 15/12/2021 |
| CVE-2020-13653 | 中危6.1 | An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature. | 02/07/2020 |
| CVE-2020-12846 | 高危8.0 | Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user wil | 03/06/2020 |
| CVE-2020-8633 | 中危5.3 | An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible. | 18/02/2020 |
| CVE-2020-7796KEV | 严重9.8 | Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. | 18/02/2020 |
| CVE-2019-11318 | 中危5.4 | Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS. | 27/01/2020 |
| CVE-2015-2249 | 中危5.4 | Zimbra Collaboration before 8.6.0 patch5 has XSS. | 27/01/2020 |
| CVE-2014-8563 | 严重9.8 | Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS. | 27/01/2020 |
| CVE-2014-5500 | 中危6.1 | Synacor Zimbra Collaboration before 8.0.8 has XSS. | 27/01/2020 |
| CVE-2015-7609 | 中危6.1 | Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra. | 30/05/2019 |
| CVE-2015-2230 | 中危6.1 | Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console. | 30/05/2019 |