Filtered by vendor Zimbra Subscriptions
Filtered by product Zimbra Collaboration Suite Subscriptions

Search

Switch to Advanced Search (Beta)
Total 31 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-10631 1 Zimbra 1 Zimbra Collaboration Suite 2026-10-08 6.5 Medium
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant.
CVE-2026-50054 1 Zimbra 1 Zimbra Collaboration Suite 2026-10-08 7.1 High
An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry.
CVE-2026-93647 1 Zimbra 1 Zimbra Collaboration Suite 2026-09-28 9.3 Critical
An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.
CVE-2026-93641 1 Zimbra 1 Zimbra Collaboration Suite 2026-09-26 9.3 Critical
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
CVE-2026-93642 1 Zimbra 1 Zimbra Collaboration Suite 2026-09-26 9.3 Critical
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
CVE-2026-93643 1 Zimbra 1 Zimbra Collaboration Suite 2026-09-26 9.8 Critical
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.
CVE-2025-53645 1 Zimbra 1 Zimbra Collaboration Suite 2026-04-15 7.5 High
Zimbra Collaboration (ZCS) before 9.0.0 Patch 46, 10.0.x before 10.0.15, and 10.1.x before 10.1.9 is vulnerable to a denial of service condition due to improper handling of excessive, comma-separated path segments in the Admin Console. An unauthenticated remote attacker can send specially crafted GET requests that trigger redundant processing and inflated responses. This leads to uncontrolled resource consumption, resulting in denial of service.
CVE-2025-71275 1 Zimbra 1 Zimbra Collaboration Suite 2026-03-25 N/A
This CVE was rejected due to being a duplicate of CVE-2024-45519.
CVE-2024-45515 1 Zimbra 3 Collaboration, Zimbra, Zimbra Collaboration Suite 2025-08-07 6.1 Medium
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient validation of the content type metadata when importing files into the briefcase. Attackers can exploit this issue by crafting a file with manipulated metadata, allowing them to bypass content type checks and execute arbitrary JavaScript within the victim's session.
CVE-2018-10939 2 Synacor, Zimbra 2 Zimbra Collaboration Suite, Zimbra Collaboration Suite 2024-11-21 N/A
Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.
CVE-2015-7610 2 Synacor, Zimbra 2 Zimbra Collaboration Suite, Zimbra Collaboration Suite 2024-11-21 N/A
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.