Vendors / Zimbra Records 95 All Threatist records
Exploited (KEV) 3
CVSS critical 10
CVSS high 23
Exploited now Zimbra records in CISA KEV
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 40
In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00868 · Published 2023-07-31 · No fix listed
Priority LOW 33
Zimbra 2013 has XSS in aspell.php
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.03253 · Published 2020-02-12 · No fix listed CWE-79
Priority LOW 31
A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01781 · Published 2020-05-05 · No fix listed CWE-79
Priority LOW 29
Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability.
CVSS 3.1 MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00483 · Published 2024-11-22 · No fix listed CWE-352
Priority LOW 23
Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration Suite (ZCS) 6.x before 6.0.15 and 7.x before 7.1.3 allows remote attackers to inject arbitrary web script or HTML…
CVSS 2.0 MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01519 · Published 2012-02-20 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
10 23 59 3 0
THREATIST.IORead the docs