Synacor: >> Zimbra Collaboration Suite >> 8.6.0 Security Vulnerabilities
Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.
CVSS Score
6.1
EPSS Score
0.013
Published
2019-05-30
Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
CVSS Score
4.8
EPSS Score
0.008
Published
2019-05-30
There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.
CVSS Score
6.1
EPSS Score
0.01
Published
2019-05-30
An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.
CVSS Score
5.3
EPSS Score
0.019
Published
2019-05-30
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.
CVSS Score
6.1
EPSS Score
0.01
Published
2019-05-29
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
CVSS Score
6.1
EPSS Score
0.074
Published
2019-05-29
CVE-2019-9621
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
Known exploited
CVSS Score
7.5
EPSS Score
0.81
Published
2019-04-30
Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.
CVSS Score
5.3
EPSS Score
0.006
Published
2018-10-03
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.
CVSS Score
8.8
EPSS Score
0.012
Published
2018-05-30
mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors.
CVSS Score
5.3
EPSS Score
0.024
Published
2018-05-10