CVSS: 6.1EPSS: 0%CPEs: 23EXPL: 0CVE-2023-24031
https://notcve.org/view.php?id=CVE-2023-24031
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary JavaScript code, leading to information disclosure. Se ha descubierto un problema en Zimbra Collaboration (ZCS) v9.0 y v8.8.15. Cross-Site Scripting (XSS) puede ocurrir, a través de uno de los atributos del endpoint /h/ del webmail, para ejecutar código JavaScript arbitrario, lo que lleva a la divulgación de información. • https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 63EXPL: 0CVE-2022-45913
https://notcve.org/view.php?id=CVE-2022-45913
An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via one of attributes in webmail URLs to execute arbitrary JavaScript code, leading to information disclosure. Se descubrió un problema en Zimbra Collaboration (ZCS) 9.0. XSS puede ocurrir a través de uno de los atributos en las URL de correo web para ejecutar código JavaScript arbitrario, lo que lleva a la divulgación de información. • https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 28EXPL: 0CVE-2022-45911
https://notcve.org/view.php?id=CVE-2022-45911
An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary JavaScript, they will not get any sensitive information. Se descubrió un problema en Zimbra Collaboration (ZCS) 9.0. XSS puede ocurrir en la página de inicio de sesión de la IU clásica inyectando código JavaScript arbitrario en el campo username. • https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2022-45912
https://notcve.org/view.php?id=CVE-2022-45912
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An authenticated admin user can upload files through the ClientUploader utility, and traverse to any other directory for remote code execution. Se descubrió un problema en Zimbra Collaboration (ZCS) 8.8.15 y 9.0. La ejecución remota de código puede realizarse a través de ClientUploader por parte de un usuario administrador autenticado. • https://gist.github.com/Threonic/e90c85e11e1ac925ff57783988779e76 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41348
https://notcve.org/view.php?id=CVE-2022-41348
An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure. Se ha detectado un problema en Zimbra Collaboration (ZCS) versión 9.0. Puede producirse un ataque de tipo XSS por medio del atributo onerror de un elemento IMG, conllevando a una divulgación de información • https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •