Skip to content
Noroxi

Synacor records

94 published records for vendor synacor.

Researcher profile

Entered KEV
18 · 19.1%
Weaponized
20 · 21.3%
Pre-auth RCE
9
With a fix record
0%
Median publish → KEV
109 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

94 records
  • CVE-2019-9670
    99Now

    mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    synacor · zimbra collaboration suiteMay 29, 2019

  • CVE-2024-45519
    99Now

    The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    synacor · zimbra collaboration suiteOct 2, 2024

  • CVE-2022-41352
    98Now

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0.

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    synacor · zimbra collaboration suiteSep 25, 2022

  • CVE-2022-37042
    97Now

    Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    synacor · zimbra collaboration suiteAug 12, 2022

  • CVE-2020-7796
    94Now

    Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    synacor · zimbra collaboration suiteFeb 18, 2020

  • CVE-2023-34192
    89Now

    Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted scr

    CriticalCVSS 9.0KEVWeaponizedEPSS 77%

    synacor · zimbra collaboration suiteJul 6, 2023

  • CVE-2022-27925
    88Now

    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.

    HighCVSS 7.2KEVWeaponizedEPSS 99%

    synacor · zimbra collaboration suiteApr 21, 2022

  • CVE-2022-27924
    88Now

    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted insta

    HighCVSS 7.5KEVWeaponizedEPSS 94%

    synacor · zimbra collaboration suiteApr 21, 2022

  • CVE-2026-73570
    86Now

    A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed

    HighCVSS 8.9KEVWeaponizedEPSS 72%

    synacor · zimbra collaboration suiteAug 13, 2026

  • CVE-2019-9621
    84Now

    Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3

    HighCVSS 7.5KEVWeaponizedEPSS 81%

    synacor · zimbra collaboration suiteApr 30, 2019

  • CVE-2025-68645
    80Now

    A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper

    HighCVSS 8.8KEVWeaponizedEPSS 49%

    synacor · zimbra collaboration suiteDec 22, 2025

  • CVE-2023-37580
    69This week

    Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

    MediumCVSS 6.1KEVWeaponizedEPSS 49%

    synacor · zimbra collaboration suiteJul 31, 2023

  • CVE-2022-24682
    63This week

    An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the w

    MediumCVSS 6.1KEVWeaponizedEPSS 31%

    synacor · zimbra collaboration suiteFeb 9, 2022

  • CVE-2018-6882
    63This week

    Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7

    MediumCVSS 6.1KEVWeaponizedEPSS 30%

    synacor · zimbra collaboration suiteMar 27, 2018

  • CVE-2025-66376
    60This week

    Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import d

    MediumCVSS 6.1KEVWeaponizedEPSS 20%

    synacor · zimbra collaboration suiteJan 5, 2026

  • CVE-2022-27926
    59Plan

    A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allo

    MediumCVSS 6.1KEVWeaponizedEPSS 18%

    synacor · zimbra collaboration suiteApr 20, 2022

  • CVE-2025-48700
    55Plan

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1.

    MediumCVSS 6.1KEVWeaponizedEPSS 2%

    synacor · zimbra collaboration suiteJun 23, 2025

  • CVE-2025-27915
    52Plan

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.

    MediumCVSS 5.4KEVWeaponizedEPSS 4%

    synacor · zimbra collaboration suiteMar 12, 2025

  • CVE-2013-7091
    46Plan

    Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2

    MediumCVSS 5.0WeaponizedEPSS 86%

    synacor · zimbra collaboration suiteDec 13, 2013

  • CVE-2025-25064
    46Plan

    SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 d

    HighCVSS 8.8Proof of conceptEPSS 37%

    synacor · zimbra collaboration suiteFeb 3, 2025

  • CVE-2024-50599
    42Plan

    A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the we

    MediumCVSS 6.1No exploitEPSS 61%

    synacor · zimbra collaboration suiteNov 7, 2024

  • CVE-2019-6980
    40Plan

    Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.

    CriticalCVSS 9.8No exploitEPSS 4%

    synacor · zimbra collaboration suiteMay 29, 2019

  • CVE-2017-6821
    40Plan

    Directory traversal vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.7.6 allows attackers to have unspecified impact via unkno

    CriticalCVSS 9.8No exploitEPSS 4%

    synacor · zimbra collaboration suiteMay 23, 2017

  • CVE-2016-9924
    40Plan

    Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks.

    CriticalCVSS 9.8No exploitEPSS 3%

    synacor · zimbra collaboration suiteMar 29, 2017

  • CVE-2017-6813
    40Plan

    A service provided by Zimbra Collaboration Suite (ZCS) before 8.7.6 fails to require needed privileges before performing a few requested ope

    CriticalCVSS 9.8No exploitEPSS 3%

    synacor · zimbra collaboration suiteMay 23, 2017