Skip to content
OpenAdvisories

Vendor

Zimbra

39 known vulnerabilities.

Products

Zimbra Collaboration Suite 22 Collaboration 9 Zimbra Collaboration Suite (ZCS) 4 Zimbra 2 zm-admin-ajax 1 zm-ajax 1 collaboration_suite 0 zimbra_collaboration 0
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-93637

    Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting

    An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple…

    Zimbra Zimbra Collaboration Suite
  • Low 3.1
    CVE-2026-73575

    In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange …

    Zimbra Collaboration
  • Low 3.1
    CVE-2026-73574

    In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Cli…

    Zimbra Collaboration
  • Low 3.1
    CVE-2026-73573

    In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document ed…

    Zimbra Collaboration
  • Low 3.1
    CVE-2026-73571

    An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization…

    Zimbra Collaboration
  • Low 3.5
    CVE-2017-20191

    Zimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scripting

    A vulnerability was found in Zimbra zm-admin-ajax up to 8.8.1. It has been classified as problematic. This affects the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js of the component Form Textbox Field Error Handler.…

    Zimbra zm-admin-ajax
  • Low 2.6
    CVE-2017-20188

    Zimbra zm-ajax XFormItem.js XFormItem.prototype.setError cross site scripting

    A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument messa…

    Zimbra zm-ajax