Zimbra

Records95All Threatist records

Exploited (KEV)3In CISA KEV

CVSS critical10CVSS 9.0–10.0

CVSS high23CVSS 7.0–8.9

Exploited now

Zimbra records in CISA KEV

TI-2026-51660 Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability CRITICAL 98KEV 2026-08-21 TI-2025-40820 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability CRITICAL 89KEV 2026-03-18 TI-2024-18266 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability CRITICAL 86KEV 2025-05-19

Components

Products in the NVD configurations · select one to filter the records

Collaboration 41 records CRITICAL Collaboration Server 6 records MEDIUM Zimbra 5 records MEDIUM Zimbra Collaboration Server 2 records MEDIUM Zimbra Collaboration Suite 2 records MEDIUM Collaboration Suite 1 record LOW Zm-ajax 1 record LOW Zm-mailbox 1 record LOW

Records

41 records in Collaboration · all components

TI-2024-18266 CVE-2024-27443 · GHSA-qrvg-mg33-q843

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.

CRITICAL 86KEV

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.24606 Published 2024-08-12 No fix listed CWE-79

TI-2024-30553 CVE-2024-45518 · GHSA-q2pq-wmhc-m7hv

An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before…

MEDIUM 59

An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.20729 Published 2024-10-22 No fix listed CWE-918

TI-2022-13998 CVE-2022-32294 · GHSA-9533-x7q2-r9j9

Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly…

MEDIUM 54

Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02521 Published 2022-07-11 No fix listed CWE-863

TI-2023-13772 CVE-2023-29382 · GHSA-wgxh-v2xq-j8vr

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute…

MEDIUM 51

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01014 Published 2023-07-06 No fix listed CWE-94

TI-2023-13771 CVE-2023-29381 · GHSA-w7wp-hxj3-m732

An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to…

MEDIUM 51

An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01024 Published 2023-07-06 No fix listed CWE-863

TI-2023-27722 CVE-2023-50808 · GHSA-4p3v-h475-6j2m

Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.

MEDIUM 48

Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00436 Published 2024-02-13 No fix listed CWE-94

TI-2021-14103 CVE-2021-35209 · GHSA-wv5j-j74p-fv28

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra…

MEDIUM 48

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02995 Published 2021-07-02 No fix listed CWE-918

TI-2023-17035 CVE-2023-34193 · GHSA-r49f-h295-cg9m

File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to…

MEDIUM 42

File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01169 Published 2023-07-06 No fix listed CWE-434

TI-2023-09816 CVE-2023-24032 · GHSA-qjgx-39q9-8r6q

In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user…

LOW 38

In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM arguments, leading to local privilege escalat…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00958 Published 2023-06-15 No fix listed CWE-77

TI-2022-17467 CVE-2022-37393 · GHSA-8jjp-3pj6-xx8j

Zimbra zmslapd arbitrary module load

LOW 37

Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.01669 Published 2022-08-16 No fix listed CWE-284

TI-2024-18265 CVE-2024-27442 · GHSA-39fv-qp4h-m8jw

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.

LOW 36

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00349 Published 2024-08-12 No fix listed CWE-269

TI-2022-22696 CVE-2022-45912 · GHSA-fh6w-cgmm-fxrj

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0.

LOW 36

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01232 Published 2022-12-05 No fix listed CWE-434

TI-2023-21728 CVE-2023-41106 · GHSA-4gwv-75cm-wm4v

An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3.

LOW 35

An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01045 Published 2023-12-07 No fix listed

TI-2024-22122 CVE-2024-33535 · GHSA-cpff-q36h-wcr2

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.

LOW 34

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00553 Published 2024-08-12 No fix listed CWE-22

TI-2022-19836 CVE-2022-41347 · GHSA-w7p3-hmmp-qmx6

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15).

LOW 34

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15).

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00418 Published 2022-09-26 No fix listed

TI-2022-17238 CVE-2022-37041 · GHSA-63w7-6gxr-7jjw

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra…

LOW 34

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00761 Published 2022-08-11 No fix listed CWE-918

TI-2021-14101 CVE-2021-35207 · GHSA-cm82-c58j-hhv5

An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0…

LOW 33

An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.03283 Published 2021-07-02 No fix listed CWE-79

TI-2020-17835 CVE-2020-35123 · GHSA-jvvx-4fhr-xxqv

In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there…

LOW 32

In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01512 Published 2020-12-17 No fix listed CWE-611

TI-2023-24217 CVE-2023-45206 · GHSA-4hpc-jmfv-gf3c

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0.

LOW 30

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00484 Published 2024-02-13 No fix listed CWE-79

TI-2023-11697 CVE-2023-26562 · GHSA-cqc2-xcqm-6c3r

In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated…

LOW 30

In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00585 Published 2024-02-13 No fix listed CWE-862

TI-2021-13801 CVE-2021-34807 · GHSA-fqph-hqc3-qf26

An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration…

LOW 29

An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00979 Published 2021-07-02 No fix listed CWE-601

TI-2023-26286 CVE-2023-48432 · GHSA-xvvw-m6mf-m9hw

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0.

LOW 28

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00465 Published 2024-02-13 No fix listed CWE-79

TI-2023-24218 CVE-2023-45207 · GHSA-gc2m-7496-w444

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0.

LOW 28

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0056 Published 2024-02-13 No fix listed CWE-79

TI-2023-23093 CVE-2023-43103 · GHSA-5qw2-vv35-xqx6

An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4…

LOW 28

An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4 via an unsanitized parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00489 Published 2023-12-07 No fix listed CWE-79

TI-2023-23092 CVE-2023-43102 · GHSA-2x5j-p7gf-w434

An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4.

LOW 28

An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00489 Published 2023-12-07 No fix listed CWE-79

Open these records in search →