CVE-2026-73576 | Medium | 6.3 | 2026-08-13 | In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJw… |
CVE-2026-73575 | Low | 3.1 | 2026-08-13 | In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Co… |
CVE-2026-73574 | Low | 3.1 | 2026-08-13 | In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu… |
CVE-2026-73573 | Low | 3.1 | 2026-08-13 | In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper vali… |
CVE-2026-73572 | Medium | 6.1 | 2026-08-13 | In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient san… |
CVE-2026-73571 | Low | 3.1 | 2026-08-13 | An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending f… |
CVE-2026-73570 | High | 8.9 | 2026-08-13 | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notificat… |
CVE-2025-66376 | High | 7.2 | 2026-01-05 | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTM… |
CVE-2025-67809 | Medium | 4.7 | 2025-12-15 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet… |
CVE-2025-62763 | Medium | 5.0 | 2025-10-21 | Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy. |
CVE-2024-45515 | Medium | 6.1 | 2025-07-30 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient val… |
CVE-2025-27914 | Medium | 5.4 | 2025-03-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoin… |
CVE-2024-9665 | Medium | 6.5 | 2024-11-22 | Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on… |
CVE-2024-45518 | High | 8.8 | 2024-10-22 | An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows… |
CVE-2024-33536 | Medium | 5.4 | 2024-08-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing… |
CVE-2024-33535 | High | 7.5 | 2024-08-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) in a web application… |
CVE-2024-33533 | Medium | 5.4 | 2024-08-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting (XSS) vulnerability has been identified in t… |
CVE-2024-27443 | Medium | 6.1 | 2024-08-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimb… |
CVE-2024-27442 | High | 7.8 | 2024-08-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user… |
CVE-2017-20191 | Low | 3.5 | 2024-03-31 | A vulnerability was found in Zimbra zm-admin-ajax up to 8.8.1. It has been classified as problematic. This affects the function XFormItem.prototype.setError of… |
CVE-2023-50808 | Medium | 6.1 | 2024-02-13 | Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI. |
CVE-2023-48432 | Medium | 6.1 | 2024-02-13 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link (for… |
CVE-2023-45207 | Medium | 6.1 | 2024-02-13 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScrip… |
CVE-2023-45206 | Medium | 6.1 | 2024-02-13 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript o… |
CVE-2023-26562 | Medium | 6.5 | 2024-02-13 | In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp. |
CVE-2017-20188 | Low | 2.6 | 2024-01-02 | A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype… |
CVE-2023-43103 | Medium | 6.1 | 2023-12-07 | An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4 via an unsanitized parameter. This is also fixed in 8.8.15 Patch 43 a… |
CVE-2023-43102 | Medium | 6.1 | 2023-12-07 | An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4. An XSS issue can be exploited to access the mailbox of an authenticated user. This is also… |
CVE-2023-41106 | High | 7.5 | 2023-12-07 | An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3. An attacker can gain access to a Zimbra account. This is also fixed in 9.0.0 Patch 35 and… |
CVE-2023-38750 | High | 7.5 | 2023-07-31 | In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed. |
CVE-2023-34193 | High | 8.8 | 2023-07-06 | File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the Clien… |
CVE-2023-29382 | Critical | 9.8 | 2023-07-06 | An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component. |
CVE-2023-29381 | Critical | 9.8 | 2023-07-06 | An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and… |
CVE-2023-24032 | High | 7.8 | 2023-06-15 | In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by pas… |
CVE-2023-24031 | Medium | 6.1 | 2023-06-15 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary Ja… |
CVE-2023-24030 | Medium | 6.1 | 2023-06-15 | An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15. To exploit the vulnerability, an attacker w… |
CVE-2022-45913 | Medium | 6.1 | 2023-01-06 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via one of attributes in webmail URLs to execute arbitrary JavaScript code, leading to… |
CVE-2022-45911 | Medium | 6.1 | 2023-01-06 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username fi… |
CVE-2022-45912 | High | 7.2 | 2022-12-05 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An… |
CVE-2022-41351 | Medium | 6.1 | 2022-10-12 | In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value… |
CVE-2022-41350 | Medium | 6.1 | 2022-10-12 | In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows… |
CVE-2022-41349 | Medium | 6.1 | 2022-10-12 | In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS. This allows executing arb… |
CVE-2022-41348 | Medium | 6.1 | 2022-10-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure. |
CVE-2022-41347 | High | 7.8 | 2022-09-26 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the zimbra user to execute the NGINX binary… |
CVE-2022-37393 | High | 7.8 | 2022-08-16 | Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zms… |
CVE-2022-37044 | Medium | 6.1 | 2022-08-12 | In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lea… |
CVE-2022-37043 | Medium | 5.7 | 2022-08-12 | An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some PO… |
CVE-2022-37041 | High | 7.5 | 2022-08-12 | An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The value of the X-Forwarded-Host header… |
CVE-2022-32294 | Critical | 9.8 | 2022-07-11 | Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartex… |
CVE-2021-35209 | Critical | 9.8 | 2021-07-02 | An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The… |
CVE-2021-35208 | Medium | 5.4 | 2021-07-02 | An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could plac… |
CVE-2021-35207 | Medium | 6.1 | 2021-07-02 | An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login compon… |
CVE-2021-34807 | Medium | 6.1 | 2021-07-02 | An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need t… |
CVE-2020-35123 | Medium | 6.5 | 2020-12-17 | In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, whic… |
CVE-2020-11737 | Medium | 6.1 | 2020-05-05 | A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execu… |
CVE-2020-10194 | Medium | 6.5 | 2020-03-20 | cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the inte… |
CVE-2013-1938 | Medium | 6.1 | 2020-02-12 | Zimbra 2013 has XSS in aspell.php |
CVE-2019-8947 | Medium | 6.1 | 2020-01-27 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS. |
CVE-2019-8946 | Medium | 6.1 | 2020-01-27 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. |
CVE-2019-8945 | Medium | 6.1 | 2020-01-27 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. |
CVE-2019-15313 | Medium | 6.1 | 2020-01-27 | In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability. |
CVE-2019-12427 | Medium | 4.8 | 2020-01-27 | Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console. |
CVE-2018-10939 | Medium | 6.1 | 2018-05-30 | Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group. |
CVE-2015-7610 | High | 8.8 | 2018-05-30 | Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, a… |
CVE-2016-5721 | Medium | 6.1 | 2016-08-29 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unsp… |
CVE-2015-6541 | High | 8.8 | 2016-04-08 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hija… |
CVE-2013-7217 | | | 2013-12-26 | Unspecified vulnerability in Zimbra Collaboration Server 7.2.5 and earlier, and 8.0.x through 8.0.5, has "critical" impact and unspecified vectors, a different… |
CVE-2012-1213 | | | 2012-02-24 | Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration Suite (ZCS) 6.x before 6.0.15 and 7.x before 7.1.3 a… |
CVE-2008-1226 | | | 2008-03-10 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration Suite (ZCS) 4.0.3, 4.5.6, and possibly other versions before 4.5.10 allow remote at… |