Advisories · Technology
Zimbra Collaboration Suite.
Every CVE that names Zimbra Collaboration Suite among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion
- Zimbra Collaboration Suite
- CWE-682
- CVSS 4.3 Medium
Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address
- Zimbra Collaboration Suite
- Other injection
- CVSS 7.8 High
Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration
- Zimbra Collaboration Suite
- Broken access control
- CVSS 7.8 High
Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions
- Zimbra Collaboration Suite
- Broken access control
- CVSS 7.8 High
Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection
- Zimbra Collaboration Suite
- Command injection
- CVSS 8.7 High
Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation
- Zimbra Collaboration Suite
- Broken access control
- CVSS 6.1 Medium
Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter
- Zimbra Collaboration Suite
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name
- Zimbra Collaboration Suite
- Other injection
- CVSS 4.3 Medium
Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records
- Zimbra Collaboration Suite
- Broken access control
- CVSS 5.4 Medium
Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters
- Zimbra Collaboration Suite
- Cross-site scripting (XSS)
- CVSS 7.1 High
Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking
- Zimbra Collaboration Suite
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
- Zimbra Collaboration Suite
- CWE-180
- CVSS 5.3 Medium
Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity
- Zimbra Collaboration Suite
- Authentication bypass
- CVSS 5.3 Medium
Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response
- Zimbra Collaboration Suite
- Authentication bypass
- CVSS 5.3 Medium
Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer
- Zimbra Collaboration Suite
- Authentication bypass
- CVSS 8.7 High
Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters
- Zimbra Collaboration Suite
- CWE-642
- CVSS 8.7 High
Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter
- Zimbra Collaboration Suite
- Cross-site scripting (XSS)
- CVSS 3.7 Low
Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting
- Zimbra Collaboration Suite
- Authentication bypass
- CVSS 5.3 Medium
Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution
- Zimbra Collaboration Suite
- Other injection
- CVSS 6.5 Medium
Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion
- Zimbra Collaboration Suite
- Broken access control
- CVSS 7.1 High
Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right
- Zimbra Collaboration Suite
- Privilege escalation
- CVSS 6.5 Medium
Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier
- Zimbra Collaboration Suite
- Broken access control