Stored Cross-Site Scripting in Zimbra

Stored Cross-Site Scripting in Zimbra

Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion

Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address

Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration

Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions

Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection

Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation

Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter

Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name

Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records

Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters

Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking

Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization

Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity

Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response

Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer

Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters

Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter

Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting

Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution

Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion

Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right

Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier

Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request

Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation

Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation

In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generat…

In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient validation of request …