GCVE - cpe:2.3:a:zimbra:zimbra:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:zimbra:zimbra:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Zimbra (`2c2042e1-5f4a-5590-841f-bd7953d2bb5f`)
Product	Zimbra (`8db03b28-f061-5022-85f8-50ba699a6a4a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/zimbra/zm-build`	purl2cpe	2026-06-01 10:12:36.159480
`pkg:sourceforge/zimbra`	purl2cpe	2026-06-01 10:12:36.159482

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-9665`	vulnerable	2026-06-08 07:00:28.426146	Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability MEDIUM (6.5) Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message. The specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939. Published: 2024-11-22T21:02:44.953Z Updated: 2024-11-23T01:26:27.732Z Open on db.gcve.eu Reference links https://www.zerodayinitiative.com/advisories/ZDI-24-1369/ https://blog.zimbra.com/2024/10/new-patch-release-reminders-for-missing-attachments-out-of-office-notifications-traffic-light-protocol-tlp-and-mailto-links/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-38750`	vulnerable	2026-06-08 06:08:18.817795	Details available In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed. Published: 2023-07-31T00:00:00.000Z Updated: 2024-10-22T17:42:37.528Z Open on db.gcve.eu Reference links https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-37580`	vulnerable	2026-06-08 06:08:15.785964	Details available Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client. Published: 2023-07-31T00:00:00.000Z Updated: 2025-10-30T18:26:19.400Z Open on db.gcve.eu Reference links https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy http://www.openwall.com/lists/oss-security/2023/11/17/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1938`	vulnerable	2026-06-08 05:03:57.356921	Details available Zimbra 2013 has XSS in aspell.php Published: 2020-02-12T15:02:24.000Z Updated: 2024-08-06T15:20:37.024Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/58913 http://www.openwall.com/lists/oss-security/2013/04/09/14 http://www.openwall.com/lists/oss-security/2013/04/09/15	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1213`	vulnerable	2026-06-08 05:00:48.240890	Details available Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration Suite (ZCS) 6.x before 6.0.15 and 7.x before 7.1.3 allows remote attackers to inject arbitrary web script or HTML via the view parameter. Published: 2012-02-20T19:00:00.000Z Updated: 2024-08-06T18:53:36.394Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/73168 http://packetstormsecurity.org/files/109710/Zimbra-Cross-Site-Scripting.html http://www.securityfocus.com/bid/51974 https://bugzilla.zimbra.com/show_bug.cgi?id=63849 http://st2tea.blogspot.com/2012/02/zimbra-cross-site-scripting.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.