Synacor Zimbra_collaboration_suite
82 CVEs affecting Synacor Zimbra_collaboration_suite. Latest disclosed: 2026-03-30. Critical: 12, High: 19.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45519 | Critical | 10.0 | 2024-10-02 | The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allow… |
CVE-2022-41352 | Critical | 9.8 | 2022-09-26 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to… |
CVE-2022-37042 | Critical | 9.8 | 2022-08-12 | Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authenticatio… |
CVE-2020-7796 | Critical | 9.8 | 2020-02-18 | Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. |
CVE-2019-9670 | Critical | 9.8 | 2019-05-29 | mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Au… |
CVE-2019-6980 | Critical | 9.8 | 2019-05-29 | Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component. |
CVE-2018-20160 | Critical | 9.8 | 2019-05-29 | ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks… |
CVE-2017-6821 | Critical | 9.8 | 2017-05-23 | Directory traversal vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.7.6 allows attackers to have unspecified impact via unknown vectors. |
CVE-2017-6813 | Critical | 9.8 | 2017-05-23 | A service provided by Zimbra Collaboration Suite (ZCS) before 8.7.6 fails to require needed privileges before performing a few requested operations. |
CVE-2016-9924 | Critical | 9.8 | 2017-03-29 | Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks. |
CVE-2016-3415 | Critical | 9.1 | 2017-01-18 | Zimbra Collaboration before 8.7.0 allows remote attackers to conduct deserialization attacks via unspecified vectors, aka bug 102276. |
CVE-2023-34192 | Critical | 9.0 | 2023-07-06 | Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoS… |
CVE-2026-33373 | High | 8.8 | 2026-03-30 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the i… |
CVE-2025-68645 | High | 8.8 | 2025-12-22 | A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-su… |
CVE-2025-32354 | High | 8.8 | 2025-04-29 | In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) o… |
CVE-2025-25064 | High | 8.8 | 2025-02-03 | SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient… |
CVE-2015-7610 | High | 8.8 | 2018-05-30 | Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, a… |
CVE-2016-3403 | High | 8.8 | 2017-05-17 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack t… |
CVE-2016-3406 | High | 8.8 | 2017-01-18 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecif… |
CVE-2020-12846 | High | 8.0 | 2020-06-03 | Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet… |