Zimbra Collaboration Suite vulnerabilities
7 known vulnerabilities in Zimbra Collaboration Suite from Zimbra. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.8 High severity
Zimbra Collaboration Suite: Incorrect Permission Assignment for Critical Resource
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wr
- 8.7 High severity
Zimbra Collaboration Suite: Missing Authorization
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add a
- 7.1 High severity
Zimbra Collaboration Suite: Cross-Site Request Forgery
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or
- 7.8 High severity
Zimbra Collaboration Suite: Incorrect Permission Assignment for Critical Resource
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration command
- 7.8 High severity
Zimbra Collaboration Suite: Improper Neutralization of Argument Delimiters in a Command
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately res
- 8.7 High severity
Zimbra Collaboration Suite: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script att
- 7.1 High severity
Zimbra Collaboration Suite: Improper Privilege Management
An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives pa