Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

184 results · page 3 of 4

Aug 16, 2022Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters.CVE-2022-37393 · Email & office · Synacor · reported by cve@rapid7.comHigh 7.8
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
Product
Zimbra Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record attackerkb.com darrenmartyn.ie
Aug 12, 2022In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and leadCVE-2022-37044 · Email & office · Zimbra · reported by MITREMedium 6.1
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine.
Product
Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
Aug 12, 2022An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0.CVE-2022-37043 · Email & office · Zimbra · reported by MITREMedium 5.7
An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views an attacker-controlled page, a request will be sent to the application that appears to be intended. The CSRF token is omitted from the request, but the request still succeeds.
Product
Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
Aug 12, 2022Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass VulnerabilityCVE-2022-37042 · Email & office · Synacor · reported by MITREExploitedRansomwareCritical 9.8
Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Aug 11, 2022 (federal fix deadline Sep 1, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com wiki.zimbra.com
Aug 12, 2022An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0.CVE-2022-37041 · Email & office · Zimbra · reported by MITREHigh 7.5
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The value of X-Forwarded-Host header is not checked against the whitelist of hosts that ZCS is allowed to proxy to (the zimbraProxyAllowedDomains setting).
Product
Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
Jul 10, 2022Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command).CVE-2022-32294 · Email & office · Zimbra · reported by MITRECritical 9.8
Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the syslog port). NOTE: a third party reports that this cannot be reproduced.
Product
Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 20, 2022Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityCVE-2022-27926 · Email & office · Synacor · reported by MITREExploitedMedium 6.1
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Apr 3, 2023 (federal fix deadline Apr 24, 2023)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Apr 20, 2022Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload VulnerabilityCVE-2022-27925 · Email & office · Synacor · reported by MITREExploitedRansomwareHigh 7.2
Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Aug 11, 2022 (federal fix deadline Sep 1, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com wiki.zimbra.com
Apr 20, 2022Synacor Zimbra Collaboration Suite (ZCS) Command Injection VulnerabilityCVE-2022-27924 · Email & office · Synacor · reported by MITREExploitedRansomwareHigh 7.5
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Aug 4, 2022 (federal fix deadline Aug 25, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Feb 8, 2022Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting VulnerabilityCVE-2022-24682 · Email & office · Synacor · reported by MITREExploitedRansomwareMedium 6.1
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.
Product
Zimbra Collaborate Suite (ZCS)
On CISA’s list since
Feb 25, 2022 (federal fix deadline Mar 11, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.zimbra.com wiki.zimbra.com
Dec 15, 2021An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing.CVE-2020-18985 · Email & office · Synacor · reported by MITREMedium 6.1
An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 15, 2021A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticatedCVE-2020-18984 · Email & office · Synacor · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 2, 2021An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16.CVE-2021-35209 · Email & office · Zimbra · reported by MITRECritical 9.8
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against the whitelist of hosts Zimbra is allowed to proxy to (the zimbraProxyAllowedDomains setting).
Product
Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.sonarsource.com wiki.zimbra.com
Jul 2, 2021An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23.CVE-2021-35208 · Email & office · Zimbra · reported by MITREMedium 5.4
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
Product
Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.sonarsource.com wiki.zimbra.com
Jul 2, 2021An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16.CVE-2021-35207 · Email & office · Zimbra · reported by MITREMedium 6.1
An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode parameter of the login url.
Product
Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
Jul 2, 2021An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0.CVE-2021-34807 · Email & office · Zimbra · reported by MITREMedium 6.1
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any URL via isredirect=1&redirectURL= in conjunction with the token data (e.g., a valid authtoken= value).
Product
Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
Dec 16, 2020In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, whichCVE-2020-35123 · Email & office · Zimbra · reported by MITREMedium 6.5
In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17.
Product
Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
Jul 2, 2020An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11.CVE-2020-13653 · Email & office · Synacor · reported by MITREMedium 6.1
An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
Jun 3, 2020Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file.CVE-2020-12846 · Email & office · Synacor · reported by MITREHigh 8
Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
May 5, 2020A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to executCVE-2020-11737 · Email & office · Zimbra · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring (including the quotes) followed immediately by a DOM event listener such as onmouseover. This is fixed in 9.0.0 Patch 2.
Product
Zimbra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.zimbra.com wiki.zimbra.com
Mar 20, 2020cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account.CVE-2020-10194 · Email & office · Zimbra · reported by MITREMedium 6.5
cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request.
Product
Zm-mailbox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 18, 2020An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7.CVE-2020-8633 · Email & office · Synacor · reported by MITREMedium 5.3
An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
Feb 18, 2020Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery VulnerabilityCVE-2020-7796 · Email & office · Synacor · reported by MITREExploitedCritical 9.8
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.
Product
Zimbra Collaboration Suite
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Feb 12, 2020Zimbra 2013 has XSS in aspell.phpCVE-2013-1938 · Email & office · Zimbra · reported by Red HatMedium 6.1
Zimbra 2013 has XSS in aspell.php
Product
Zimbra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 27, 2020Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS.CVE-2019-8947 · Email & office · Zimbra · reported by MITREMedium 6.1
Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS.
Product
Collaboration Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com bugzilla.zimbra.com
Jan 27, 2020Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.CVE-2019-8946 · Email & office · Zimbra · reported by MITREMedium 6.1
Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.
Product
Collaboration Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com bugzilla.zimbra.com
Jan 27, 2020Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.CVE-2019-8945 · Email & office · Zimbra · reported by MITREMedium 6.1
Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.
Product
Collaboration Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com bugzilla.zimbra.com
Jan 27, 2020In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability.CVE-2019-15313 · Email & office · Zimbra · reported by MITREMedium 6.1
In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability.
Product
Collaboration Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com wiki.zimbra.com
Jan 27, 2020Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console.CVE-2019-12427 · Email & office · Zimbra · reported by MITREMedium 4.8
Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console.
Product
Collaboration Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com wiki.zimbra.com
Jan 27, 2020Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS.CVE-2019-11318 · Email & office · Synacor · reported by MITREMedium 5.4
Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS.
Product
Zimbra Collaboration Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com wiki.zimbra.com
Jan 27, 2020Zimbra Collaboration before 8.6.0 patch5 has XSS.CVE-2015-2249 · Email & office · Synacor · reported by MITREMedium 5.4
Zimbra Collaboration before 8.6.0 patch5 has XSS.
Product
Zimbra Collaboration Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
Jan 27, 2020Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS.CVE-2014-8563 · Email & office · Synacor · reported by MITRECritical 9.8
Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS.
Product
Zimbra Collaboration Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com wiki.zimbra.com
Jan 27, 2020Synacor Zimbra Collaboration before 8.0.8 has XSS.CVE-2014-5500 · Email & office · Synacor · reported by MITREMedium 6.1
Synacor Zimbra Collaboration before 8.0.8 has XSS.
Product
Zimbra Collaboration Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
May 30, 2019Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.CVE-2015-7609 · Email & office · Synacor · reported by MITREMedium 6.1
Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com bugzilla.zimbra.com
May 30, 2019Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.CVE-2015-2230 · Email & office · Synacor · reported by MITREMedium 6.1
Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.
Product
Zimbra Collaboration Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com wiki.zimbra.com
May 30, 2019There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch CVE-2018-14425 · Email & office · Synacor · reported by MITREMedium 6.1
There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com wiki.zimbra.com
May 30, 2019Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.CVE-2018-10948 · Email & office · Synacor · reported by MITREMedium 4.8
Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com bugzilla.zimbra.com
May 30, 2019An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 beCVE-2018-15131 · Email & office · Synacor · reported by MITREMedium 5.3
An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com wiki.zimbra.com
May 29, 2019Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity ReferenceCVE-2019-9670 · Email & office · Synacor · reported by MITREExploitedCritical 9.8
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com rapid7.com
May 29, 2019Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.CVE-2019-6981 · Email & office · Synacor · reported by MITREMedium 6.5
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com wiki.zimbra.com
May 29, 2019Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.CVE-2019-6980 · Email & office · Synacor · reported by MITRECritical 9.8
Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com wiki.zimbra.com
May 29, 2019ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, CVE-2018-20160 · Email & office · Synacor · reported by MITRECritical 9.8
ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com wiki.zimbra.com
May 29, 2019mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.CVE-2018-18631 · Email & office · Synacor · reported by MITREMedium 6.1
mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com wiki.zimbra.com
May 29, 2019Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.CVE-2018-14013 · Email & office · Synacor · reported by MITREMedium 6.1
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Apr 30, 2019Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) VulnerabilityCVE-2019-9621 · Email & office · Synacor · reported by MITREExploitedHigh 7.5
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Jul 7, 2025 (federal fix deadline Jul 28, 2025)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Oct 3, 2018Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.CVE-2018-17938 · Email & office · Synacor · reported by MITREMedium 5.3
Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com wiki.zimbra.com
May 30, 2018Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.CVE-2018-10939 · Email & office · Synacor · reported by MITREMedium 6.1
Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.zimbra.com wiki.zimbra.com
May 30, 2018Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, anCVE-2015-7610 · Email & office · Synacor · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.zimbra.com blog.zimbra.com
May 9, 2018mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetCVE-2018-10951 · Email & office · Synacor · reported by MITREMedium 6.5
mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Admin SOAP API.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com bugzilla.zimbra.com
May 9, 2018mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose ErroCVE-2018-10950 · Email & office · Synacor · reported by MITREMedium 5.3
mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages containing a stack dump, tracing data, or full user-context dump.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.zimbra.com bugzilla.zimbra.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.