Zimbra Collaboration Suite (ZCS) vulnerabilities

Directory traversal vulnerability in Zimbra Collaboration Suite (ZCS) before version 8.7.6 allows attackers to have unspecified impact via unknown vectors.

A service provided by Zimbra Collaboration Suite (ZCS) before version 8.7.6 fails to require needed privileges before performing a few requested operations.

Zimbra Collaboration Suite (ZCS) before version 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks.

A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The configuration can add an attacker-controlled domain to the proxy allowlist of the default class of service; if a signed-in user opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin, enabling mailbox data theft and authenticated actions as the victim.