Synacor
Synacor Zimbra Collaboration Suite: vulnerabilidades y CVE
Synacor Zimbra Collaboration Suite tiene 89 vulnerabilidades publicadas, 15 de ellas en los últimos 12 meses. 12 son críticas y 18 figuran en el catálogo de explotación activa de CISA.
CVE89
Últimos 12 meses15
Críticas12
Explotadas activamente18
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-73570 | Alta (8.9) | 72% | ⚠ Explotación activa | 13 ago 2026 | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted… |
| CVE-2025-48700 | Media (6.1) | 1.7% | ⚠ Explotación activa | 23 jun 2025 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the… |
| CVE-2025-66376 | Media (6.1) | 20% | ⚠ Explotación activa | 5 ene 2026 | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message. |
| CVE-2020-7796 | Crítica (9.8) | 84% | ⚠ Explotación activa | 18 feb 2020 | Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. |
| CVE-2025-68645 | Alta (8.8) | 49% | ⚠ Explotación activa | 22 dic 2025 | A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An… |
| CVE-2025-27915 | Media (5.4) | 4.1% | ⚠ Explotación activa | 12 mar 2025 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS… |
| CVE-2019-9621 | Alta (7.5) | 81% | ⚠ Explotación activa | 30 abr 2019 | Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. |
| CVE-2023-34192 | Crítica (9) | 77% | ⚠ Explotación activa | 6 jul 2023 | Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function. |
| CVE-2024-45519 | Crítica (9.8) | 100% | ⚠ Explotación activa | 2 oct 2024 | The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands. |
| CVE-2023-37580 | Media (6.1) | 49% | ⚠ Explotación activa | 31 jul 2023 | Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client. |
| CVE-2022-27926 | Media (6.1) | 18% | ⚠ Explotación activa | 21 abr 2022 | A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via… |
| CVE-2022-41352 | Crítica (9.8) | 95% | ⚠ Explotación activa | 26 sept 2022 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to… |
| CVE-2022-37042 | Crítica (9.8) | 92% | ⚠ Explotación activa | 12 ago 2022 | Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload… |
| CVE-2022-27925 | Alta (7.2) | 99% | ⚠ Explotación activa | 20 abr 2022 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary… |
| CVE-2022-27924 | Alta (7.5) | 94% | ⚠ Explotación activa | 20 abr 2022 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of… |
| CVE-2018-6882 | Media (6.1) | 30% | ⚠ Explotación activa | 27 mar 2018 | Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary… |
| CVE-2022-24682 | Media (6.1) | 31% | ⚠ Explotación activa | 9 feb 2022 | An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing… |
| CVE-2019-9670 | Crítica (9.8) | 100% | ⚠ Explotación activa | 29 may 2019 | mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml. |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-73576 | Media (6.5) | 0.33% | — | 13 ago 2026 | In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number… |
| CVE-2026-73575 | Baja (3.5) | 0.15% | — | 13 ago 2026 | In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient validation of request… |
| CVE-2026-73574 | Media (6.5) | 0.33% | — | 13 ago 2026 | In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit… |
| CVE-2026-73573 | Media (6.5) | 0.45% | — | 13 ago 2026 | In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker… |
| CVE-2026-73572 | Media (6.1) | 0.26% | — | 13 ago 2026 | In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline… |
| CVE-2026-73571 | Media (4.3) | 0.26% | — | 13 ago 2026 | An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially… |
| CVE-2026-73570 | Alta (8.9) | 72% | ⚠ Explotación activa | 13 ago 2026 | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted… |
| CVE-2026-33373 | Alta (8.8) | 0.32% | — | 30 mar 2026 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection… |
| CVE-2026-33372 | Media (5.4) | 0.21% | — | 20 mar 2026 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A cross-site request forgery (CSRF) vulnerability exists in Zimbra Webmail due to improper validation of CSRF tokens. The application accepts CSRF… |
| CVE-2026-33371 | Media (4.3) | 0.39% | — | 20 mar 2026 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An… |
| CVE-2026-33370 | Media (6.1) | 0.34% | — | 20 mar 2026 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Zimbra Briefcase feature due to insufficient sanitization of specific uploaded file… |
| CVE-2026-33369 | Media (4.3) | 0.38% | — | 20 mar 2026 | Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP injection vulnerability in the Mailbox SOAP service within a FolderAction operation. The application fails to properly sanitize user-supplied input before… |
| CVE-2026-33368 | Media (6.1) | 0.37% | — | 20 mar 2026 | Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest). The application fails to properly sanitize user-supplied… |
| CVE-2025-66376 | Media (6.1) | 20% | ⚠ Explotación activa | 5 ene 2026 | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message. |
| CVE-2025-68645 | Alta (8.8) | 49% | ⚠ Explotación activa | 22 dic 2025 | A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An… |
| CVE-2025-48700 | Media (6.1) | 1.7% | ⚠ Explotación activa | 23 jun 2025 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the… |
| CVE-2024-45516 | Media (6.1) | 0.41% | — | 14 may 2025 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI… |
| CVE-2025-32354 | Alta (8.8) | 0.31% | — | 29 abr 2025 | In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due to a lack of CSRF token validation.… |
| CVE-2025-27915 | Media (5.4) | 4.1% | ⚠ Explotación activa | 12 mar 2025 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS… |
| CVE-2025-25065 | Media (5.3) | 0.59% | — | 3 feb 2025 | SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to internal network endpoints. |
| CVE-2025-25064 | Alta (8.8) | 37% | — | 3 feb 2025 | SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated… |
| CVE-2024-54663 | Alta (7.5) | 0.59% | — | 19 dic 2024 | An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers… |
| CVE-2024-45517 | Media (5.4) | 0.52% | — | 21 nov 2024 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability in the /h/rest endpoint of the Zimbra webmail and admin panel interfaces allows attackers to execute… |
| CVE-2024-45513 | Media (4.8) | 0.38% | — | 21 nov 2024 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/contacts/print endpoint of Zimbra webmail. This allows an attacker to inject… |
| CVE-2024-45194 | Media (4.8) | 0.46% | — | 21 nov 2024 | In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads. An attacker with administrative access to the Zimbra Administration… |
| CVE-2024-45514 | Media (5.4) | 0.63% | — | 21 nov 2024 | An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoints of Zimbra Webmail due to insufficient sanitization of the packages… |
| CVE-2024-45512 | Media (5.4) | 0.38% | — | 21 nov 2024 | An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1. An attacker can exploit this vulnerability by creating a folder in the Briefcase module with a malicious payload and sharing it with a… |
| CVE-2024-45510 | Media (5.4) | 0.31% | — | 20 nov 2024 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. Zimbra Webmail (Modern UI) is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper sanitization of user input. This allows an… |
| CVE-2024-45511 | Media (5.4) | 0.31% | — | 20 nov 2024 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A reflected Cross-Site Scripting (XSS) issue exists through the Briefcase module due to improper sanitization of file content by the OnlyOffice… |
| CVE-2024-50599 | Media (6.1) | 61% | — | 7 nov 2024 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints. This arises from improper handling of user-supplied… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.