Zimbra Collaboration Suite (ZCS) vulnerabilities
4 known vulnerabilities in Zimbra Collaboration Suite (ZCS) from Zimbra. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.3 Critical severity
Zimbra Collaboration Suite (ZCS): Improper Neutralization of Input During Web Page Generation
An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.
- 9.8 Critical severity
Zimbra Collaboration Suite (ZCS): Improper Limitation of a Pathname to a Restricted Directory
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.
- 9.3 Critical severity
Zimbra Collaboration Suite (ZCS): Improper Neutralization of Input During Web Page Generation
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
- 9.3 Critical severity
Zimbra Collaboration Suite (ZCS): Improper Neutralization of Input During Web Page Generation
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.