Threat database

CVE-2020-7796 is a server-side request forgery (SSRF) vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that occurs if the WebEx zimlet is installed and the zimlet JSP is enabled. This vulnerability has been exploited in the wild and is considered high severity.

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.

KEVEPSS 48%VulnerabilitySynacorUnited StatesUnited Kingdom+8

CVE-2019-9621 is a server-side request forgery (SSRF) vulnerability in the ProxyServlet component of Synacor Zimbra Collaboration Suite (ZCS). This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.

CVE-2025-48700 is a Cross-Site Scripting (XSS) vulnerability affecting Zimbra Collaboration Suite (ZCS) versions 8.8.15, 9.0, 10.0, and 10.1 in the Classic UI. The flaw allows attackers to execute arbitrary JavaScript within a user's session by sending a crafted email containing malicious HTML with an @import directive and other script injection vectors. Exploitation occurs when a user views the malicious email, requiring no further interaction. This can lead to unauthorized access to sensitive information within the affected session. The vulnerability has a CVSS score of 6.

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

KEVMirageEPSS 4.1%VulnerabilitySynacorUnited StatesGermany+8

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

KEVEPSS 99%VulnerabilitySynacorGermanyFrance+8

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

KEVEPSS 49%VulnerabilitySynacorGermanyFrance+6

CVE-2022-27926 is a high-severity cross-site scripting (XSS) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). The vulnerability arises because an endpoint URL accepts parameters without proper sanitization, allowing malicious scripts to be injected. This flaw has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2022-41352 is a high-severity vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that allows attackers to upload arbitrary files via a cpio package. This flaw enables unauthorized access to other user accounts. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided.

CVE-2022-27925 is a high-severity vulnerability in Synacor Zimbra Collaboration Suite (ZCS) affecting the mboximport functionality. It allows an authenticated attacker to upload arbitrary files, enabling remote code execution. This vulnerability has been exploited in the wild and has been chained with CVE-2022-37042, which permits unauthenticated remote code execution. The vulnerability is known to have been used in ransomware campaigns.

CVE-2022-37042 is an authentication bypass vulnerability in Synacor Zimbra Collaboration Suite (ZCS) affecting the MailboxImportServlet component. This vulnerability has been exploited in the wild and was chained with CVE-2022-27925 to enable unauthenticated remote code execution. The issue has a high severity level and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

CVE-2022-27924 is a command injection vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that allows attackers to inject memcache commands, leading to arbitrary cached entry overwrites. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided.

Synacor Zimbra Collaboration Suite (ZCS) has a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web scripts or HTML. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided.

CVE-2022-24682 is a high-severity cross-site scripting (XSS) vulnerability in the Calendar feature of Synacor Zimbra Collaboration Suite (ZCS). This flaw allows attackers to execute arbitrary code by injecting malicious scripts. The vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

CVE-2019-9670 is an XML External Entity (XXE) vulnerability in the mailboxd component of Synacor Zimbra Collaboration Suite (ZCS). This vulnerability allows improper restriction of XML external entity references, which can be exploited to access unauthorized data or cause denial of service. It has been exploited in the wild and is considered high severity.