Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Zimbra_collaboration_suite
(Synacor)Repositories |
Unknown: This might be proprietary software. |
#Vulnerabilities | 63 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2017-01-18 | CVE-2016-3405 | Multiple unspecified vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to affect integrity via unknown vectors, aka bugs 103961 and 104828. | Zimbra_collaboration_suite | 7.5 | ||
2017-01-18 | CVE-2016-3404 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 103959. | Zimbra_collaboration_suite | 7.5 | ||
2017-05-17 | CVE-2016-3403 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that (1) add, (2) modify, or (3) remove accounts by leveraging failure to use of a CSRF token and perform referer header checks, aka bugs 100885 and 100899. | Zimbra_collaboration_suite | 8.8 | ||
2017-01-18 | CVE-2016-3402 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect confidentiality via unknown vectors, aka bug 99167. | Zimbra_collaboration_suite | 7.5 | ||
2017-01-18 | CVE-2016-3401 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote authenticated users to affect integrity via unknown vectors, aka bug 99810. | Zimbra_collaboration_suite | 6.5 | ||
2018-05-30 | CVE-2015-7610 | Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token. | Zimbra_collaboration_suite, Zimbra_collaboration_suite | 8.8 | ||
2013-12-13 | CVE-2013-7091 | Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the skin parameter. NOTE: this can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service/admin/soap API. | Zimbra_collaboration_suite | N/A | ||
2013-09-23 | CVE-2013-5119 | Zimbra Collaboration Suite (ZCS) 6.0.16 and earlier allows man-in-the-middle attackers to obtain access by sniffing the network and replaying the ZM_AUTH_TOKEN token. | Zimbra_collaboration_suite | N/A | ||
2018-05-10 | CVE-2018-10950 | mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages containing a stack dump, tracing data, or full user-context dump. | Zimbra_collaboration_suite | 5.3 | ||
2019-05-30 | CVE-2018-14425 | There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1. | Zimbra_collaboration_suite | 6.1 |