[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGXtsPOSa0gyJCNUdN0tSmHf1646AVub7Ri9GucjXhHQ":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":29,"kevVulnerabilities":90,"topProductsByCves":138,"seoMetadata":141,"meta":150},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":28},30922,"synacor",2,67,9,145,"2025-05-14","s",[16,21],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},160463,"zimbra_collaboration_suite",93,62,{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":26,"last_cve_update":27},160462,"zimbra_collaboration_server",52,5,0,"2020-01-27","Synacor is a technology vendor with 2 tracked products and 67 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[30,38,45,50,58,63,68,73,79,85],{"cveId":31,"description":32,"publishedDate":33,"cvssScore":34,"cvssVersion":35,"severity":36,"isKev":4,"epssScore":37},"CVE-2019-9670","mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover\u002FAutodiscover.xml.","2019-05-29",9.8,"v3.1","Critical",0.99986,{"cveId":39,"description":40,"publishedDate":41,"cvssScore":42,"cvssVersion":35,"severity":43,"isKev":4,"epssScore":44},"CVE-2022-27925","Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.","2022-04-21",7.2,"High",0.98676,{"cveId":46,"description":47,"publishedDate":41,"cvssScore":48,"cvssVersion":35,"severity":43,"isKev":4,"epssScore":49},"CVE-2022-27924","Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.",7.5,0.93908,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":25,"cvssVersion":54,"severity":55,"isKev":56,"epssScore":57},"CVE-2013-7091","Directory traversal vulnerability in \u002Fres\u002FI18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a ..  (dot dot) in the skin parameter.  NOTE: this can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service\u002Fadmin\u002Fsoap API.","2013-12-13","v2","Medium",false,0.86311,{"cveId":59,"description":60,"publishedDate":61,"cvssScore":34,"cvssVersion":35,"severity":36,"isKev":4,"epssScore":62},"CVE-2020-7796","Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.","2020-02-18",0.84418,{"cveId":64,"description":65,"publishedDate":66,"cvssScore":48,"cvssVersion":35,"severity":43,"isKev":4,"epssScore":67},"CVE-2019-9621","Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.","2019-04-30",0.81037,{"cveId":69,"description":70,"publishedDate":71,"cvssScore":11,"cvssVersion":35,"severity":36,"isKev":4,"epssScore":72},"CVE-2023-34192","Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the \u002Fh\u002FautoSaveDraft function.","2023-07-06",0.77266,{"cveId":74,"description":75,"publishedDate":76,"cvssScore":77,"cvssVersion":35,"severity":55,"isKev":4,"epssScore":78},"CVE-2023-37580","Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.","2023-07-31",6.1,0.49083,{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"cvssVersion":35,"severity":43,"isKev":56,"epssScore":84},"CVE-2025-25064","SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.","2025-02-03",8.8,0.36726,{"cveId":86,"description":87,"publishedDate":88,"cvssScore":77,"cvssVersion":35,"severity":55,"isKev":4,"epssScore":89},"CVE-2018-6882","Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.","2018-03-27",0.29761,[91,100,104,108,112,116,123,127,131,134],{"cveId":92,"description":93,"publishedDate":94,"cvssScore":42,"cvssVersion":35,"severity":43,"isKev":4,"epssScore":95,"cisaVulnName":96,"cisaDateAdded":97,"cisaShortDescription":98,"cisaRequiredAction":99},"CVE-2025-66376","Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.","2026-01-05",0.20227,"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability","2026-03-18","Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":59,"description":60,"publishedDate":61,"cvssScore":34,"cvssVersion":35,"severity":36,"isKev":4,"epssScore":62,"cisaVulnName":101,"cisaDateAdded":102,"cisaShortDescription":103,"cisaRequiredAction":99},"Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability","2026-02-17","Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.",{"cveId":64,"description":65,"publishedDate":66,"cvssScore":48,"cvssVersion":35,"severity":43,"isKev":4,"epssScore":67,"cisaVulnName":105,"cisaDateAdded":106,"cisaShortDescription":107,"cisaRequiredAction":99},"Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability","2025-07-07","Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component.",{"cveId":69,"description":70,"publishedDate":71,"cvssScore":11,"cvssVersion":35,"severity":36,"isKev":4,"epssScore":72,"cisaVulnName":109,"cisaDateAdded":110,"cisaShortDescription":111,"cisaRequiredAction":99},"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","2025-02-25","Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the \u002Fh\u002FautoSaveDraft function.",{"cveId":74,"description":75,"publishedDate":76,"cvssScore":77,"cvssVersion":35,"severity":55,"isKev":4,"epssScore":78,"cisaVulnName":109,"cisaDateAdded":113,"cisaShortDescription":114,"cisaRequiredAction":115},"2023-07-27","Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":117,"description":118,"publishedDate":41,"cvssScore":77,"cvssVersion":35,"severity":55,"isKev":4,"epssScore":119,"cisaVulnName":109,"cisaDateAdded":120,"cisaShortDescription":121,"cisaRequiredAction":122},"CVE-2022-27926","A reflected cross-site scripting (XSS) vulnerability in the \u002Fpublic\u002FlaunchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.",0.17634,"2023-04-03","Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.","Apply updates per vendor instructions.",{"cveId":39,"description":40,"publishedDate":41,"cvssScore":42,"cvssVersion":35,"severity":43,"isKev":4,"epssScore":44,"cisaVulnName":124,"cisaDateAdded":125,"cisaShortDescription":126,"cisaRequiredAction":122},"Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability","2022-08-11","Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.",{"cveId":46,"description":47,"publishedDate":41,"cvssScore":48,"cvssVersion":35,"severity":43,"isKev":4,"epssScore":49,"cisaVulnName":128,"cisaDateAdded":129,"cisaShortDescription":130,"cisaRequiredAction":122},"Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability","2022-08-04","Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.",{"cveId":86,"description":87,"publishedDate":88,"cvssScore":77,"cvssVersion":35,"severity":55,"isKev":4,"epssScore":89,"cisaVulnName":109,"cisaDateAdded":132,"cisaShortDescription":133,"cisaRequiredAction":122},"2022-04-19","Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.",{"cveId":31,"description":32,"publishedDate":33,"cvssScore":34,"cvssVersion":35,"severity":36,"isKev":4,"epssScore":37,"cisaVulnName":135,"cisaDateAdded":136,"cisaShortDescription":137,"cisaRequiredAction":122},"Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference","2022-01-10","Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.",[139,140],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":26,"last_cve_update":27},{"title":142,"metaDescription":143,"keywords":144,"structuredData":145},"Synacor - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Synacor covering 2 products with 67 tracked vulnerabilities including 3 critical and 4 high-severity issues and 9 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Synacor vulnerabilities, Synacor security, Synacor CVE, Synacor threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Synacor KEV, Synacor exploited vulnerabilities",{"@context":146,"@type":147,"name":148,"description":143,"url":149},"https:\u002F\u002Fschema.org","Organization","Synacor","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fsynacor",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":151,"apiVersion":152},"2026-10-18T16:40:41.977Z","3.0"]