Synacor Zimbra Collaboration Suite (ZCS) 10.1.0

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:synacor:zimbra_collaboration_suite:10.1.0:*:*:*:*:*:*:*

part: a version: 10.1.0 update: *

VendorSynacor (c68ec80d-d30e-5207-9d78-e97400e9956b)
ProductZimbra Collaboration Suite (f968d556-0a02-5a8f-96e3-822a38d8f1db)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/zimbra/zm-build purl2cpe 2026-06-01 10:11:13.888157
pkg:zimbra/zimbra-collaboration purl2cpe 2026-06-01 10:11:13.888159

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-45519 vulnerable 2026-06-08 06:48:06.689159 Details available
CRITICAL (10)
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
Published: 2024-10-02T00:00:00.000Z
Updated: 2026-02-03T19:27:04.871Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-45514 vulnerable 2026-06-08 06:48:06.545033 Details available
An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoints of Zimbra Webmail due to insufficient sanitization of the packages parameter. Attackers can bypass the existing checks by using encoded characters, allowing the injection and execution of arbitrary JavaScript within a victim's session.
Published: 2024-11-21T00:00:00.000Z
Updated: 2024-11-21T18:11:27.957Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-45513 vulnerable 2026-06-08 06:48:06.464395 Details available
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/contacts/print endpoint of Zimbra webmail. This allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser when a crafted vCard (VCF) file is processed and printed. This could lead to unauthorized actions within the victim's session.
Published: 2024-11-21T00:00:00.000Z
Updated: 2024-11-21T18:03:40.186Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-45512 vulnerable 2026-06-08 06:48:06.460961 Details available
An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1. An attacker can exploit this vulnerability by creating a folder in the Briefcase module with a malicious payload and sharing it with a victim. When the victim interacts with the folder share notification, the malicious script executes in their browser. This stored Cross-Site Scripting (XSS) vulnerability can lead to unauthorized actions within the victim's session.
Published: 2024-11-21T00:00:00.000Z
Updated: 2024-11-21T18:11:28.172Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-45511 vulnerable 2026-06-08 06:48:06.458116 Details available
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A reflected Cross-Site Scripting (XSS) issue exists through the Briefcase module due to improper sanitization of file content by the OnlyOffice formatter. This occurs when the victim opens a crafted URL pointing to a shared folder containing a malicious file uploaded by the attacker. The vulnerability allows the attacker to execute arbitrary JavaScript in the context of the victim's session.
Published: 2024-11-20T00:00:00.000Z
Updated: 2024-11-20T20:57:53.794Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-45194 vulnerable 2026-06-08 06:45:55.584590 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.