CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 02/07/2021 |
| CVE-2020-35123 | 中危6.5 | In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17. | 17/12/2020 |
| CVE-2020-11737 | 中危6.1 | A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring (including the quotes) followed immediately by a DO | 05/05/2020 |
| CVE-2020-10194 | 中危6.5 | cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request. | 20/03/2020 |
| CVE-2013-1938 | 中危6.1 | Zimbra 2013 has XSS in aspell.php | 12/02/2020 |
| CVE-2019-8947 | 中危6.1 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS. | 27/01/2020 |
| CVE-2019-8946 | 中危6.1 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. | 27/01/2020 |
| CVE-2019-8945 | 中危6.1 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. | 27/01/2020 |
| CVE-2019-15313 | 中危6.1 | In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability. | 27/01/2020 |
| CVE-2019-12427 | 中危4.8 | Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console. | 27/01/2020 |
| CVE-2018-10939 | 中危6.1 | Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group. | 30/05/2018 |
| CVE-2015-7610 | 高危8.8 | Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token. | 30/05/2018 |
| CVE-2016-5721 | 中危6.1 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 29/08/2016 |
| CVE-2015-6541 | 高危8.8 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to service/soap/BatchRequest. | 08/04/2016 |
| CVE-2013-7217 | 严重10.0 | Unspecified vulnerability in Zimbra Collaboration Server 7.2.5 and earlier, and 8.0.x through 8.0.5, has "critical" impact and unspecified vectors, a different vulnerability than CVE-2013-7091. | 26/12/2013 |
| CVE-2008-1226 | 中危4.3 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration Suite (ZCS) 4.0.3, 4.5.6, and possibly other versions before 4.5.10 allow remote attackers to inject arbitrary web script or HTML via an e-mail attachment, possibly involving a (1) .jpg or (2) .gif image attachment. | 10/03/2008 |