{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration versions 10.1.x ant\u00e9rieures \u00e0 10.1.13",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration versions 10.0.x ant\u00e9rieures \u00e0 10.0.18",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-66376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66376"
    }
  ],
  "initial_release_date": "2025-11-06T00:00:00",
  "last_revision_date": "2025-12-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0970",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-11-06T00:00:00.000000"
    },
    {
      "description": "Ajout de l\u0027identifiant CVE-2025-66376",
      "revision_date": "2025-12-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Synacor Zimbra Collaboration. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et une injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": "2025-11-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71240"
    },
    {
      "published_at": "2025-11-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71244"
    },
    {
      "published_at": "2025-11-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71248"
    },
    {
      "published_at": "2025-11-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71246"
    },
    {
      "published_at": "2025-11-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71247"
    },
    {
      "published_at": "2025-11-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71242"
    },
    {
      "published_at": "2025-11-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71245"
    },
    {
      "published_at": "2025-11-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71243"
    },
    {
      "published_at": "2025-11-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71239"
    },
    {
      "published_at": "2025-11-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71250"
    },
    {
      "published_at": "2025-11-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71241"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration versions 10.1.x ant\u00e9rieures \u00e0 10.1.12",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2025-10-16T00:00:00",
  "last_revision_date": "2025-10-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0887",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-10-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Synacor Zimbra Collaboration. Elle permet \u00e0 un attaquant de provoquer une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF).",
  "title": "Vuln\u00e9rabilit\u00e9 dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": "2025-10-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor 10.1.12",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.12"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration versions 10.0.x ant\u00e9rieures \u00e0 10.0.16",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration versions 10.1.x ant\u00e9rieures \u00e0 10.1.10",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-54390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-54390"
    },
    {
      "name": "CVE-2025-54391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-54391"
    },
    {
      "name": "CVE-2025-27789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-27789"
    }
  ],
  "links": [],
  "reference": "CERTFR-2025-AVI-0609",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-07-21T00:00:00.000000"
    },
    {
      "description": "Ajout r\u00e9f\u00e9rence CVE CVE-2025-54390 et CVE-2025-54391",
      "revision_date": "2025-07-22T00:00:00.000000"
    },
    {
      "description": "Ajout r\u00e9f\u00e9rence CVE CVE-2025-27789",
      "revision_date": "2025-07-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Synacor Zimbra Collaboration. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": "2025-07-18",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor 10.0.16",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.16"
    },
    {
      "published_at": "2025-07-18",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor 10.1.10",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.10"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration versions ant\u00e9rieures \u00e0 9.0.0 Patch 46",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration versions 10.1.x ant\u00e9rieures \u00e0 10.1.9",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration versions 10.0.x ant\u00e9rieures \u00e0 10.0.15",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur annonce la fin de vie de Zimbra Collaboration versions 9.0.x et 10.0.x. Ces branches ne recevront plus de correctifs de s\u00e9curit\u00e9 \u00e0 partir du 30 juin 2025. L\u0027\u00e9diteur recommande aux utilisateurs de migrer en version 10.1.x.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2025-AVI-0521",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-06-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Synacor Zimbra Collaboration. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": "2025-06-18",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 9.0.0 Patch 46",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P46"
    },
    {
      "published_at": "2025-06-18",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 10.0.15",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.15"
    },
    {
      "published_at": "2025-06-18",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 10.1.9",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.9"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration versions ant\u00e9rieures \u00e0 9.0.0 Patch 45",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration versions 10.0.x ant\u00e9rieures \u00e0 10.0.14",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration versions 10.1.x ant\u00e9rieures \u00e0 10.1.8",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2025-AVI-0416",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-05-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Synacor Zimbra Collaboration. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": "2025-05-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71064"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration versions 10.1.x ant\u00e9rieures \u00e0 10.1.8",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-20128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20128"
    },
    {
      "name": "CVE-2024-20505",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20505"
    }
  ],
  "links": [],
  "reference": "CERTFR-2025-AVI-0414",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-05-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Synacor Zimbra Collaboration. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": "2025-05-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71058"
    },
    {
      "published_at": "2025-05-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71057"
    },
    {
      "published_at": "2025-05-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=71059"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration versions 9.0.0.x ant\u00e9rieures \u00e0 9.0.0 Patch 44",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration versions 10.0.x ant\u00e9rieures \u00e0 10.0.13",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration versions 10.1.x ant\u00e9rieures \u00e0 10.1.5",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-27915",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-27915"
    }
  ],
  "links": [],
  "reference": "CERTFR-2025-AVI-0074",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-01-28T00:00:00.000000"
    },
    {
      "description": "Ajout r\u00e9f\u00e9rence CVE",
      "revision_date": "2025-04-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Synacor Zimbra Collaboration. Elle permet \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Vuln\u00e9rabilit\u00e9 dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": "2025-01-27",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 10.0.13",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13"
    },
    {
      "published_at": "2025-01-27",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 9.0.0 Patch 44",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44"
    },
    {
      "published_at": "2025-01-27",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 10.1.5",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration Daffodil (10.0.0) sans le correctif 10.0.12",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration Joule (8.8.15) sans le correctif 47",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration Kepler (9.0.0) sans le correctif 43",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration Daffodil (10.1.0) sans le correctif 10.1.4",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-45516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45516"
    },
    {
      "name": "CVE-2025-25064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-25064"
    },
    {
      "name": "CVE-2025-48700",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48700"
    },
    {
      "name": "CVE-2025-25065",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-25065"
    }
  ],
  "initial_release_date": "2024-12-18T00:00:00",
  "last_revision_date": "2025-12-04T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-1090",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-12-18T00:00:00.000000"
    },
    {
      "description": "Ajout des identifiants CVE CVE-2025-25064 et CVE-2025-25065.",
      "revision_date": "2025-02-03T00:00:00.000000"
    },
    {
      "description": "Ajout de l\u0027identifiant CVE-2025-48700.",
      "revision_date": "2025-12-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Synacor Zimbra Collaboration. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une injection de code indirecte \u00e0 distance (XSS) et une injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": "2024-12-17",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Synacor Zimbra Collaboration 9.0.0 Patch 43",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P43"
    },
    {
      "published_at": "2024-12-17",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 10.1.4",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4"
    },
    {
      "published_at": "2024-12-17",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Synacor Zimbra Collaboration 8.8.15 Patch P47",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P47"
    },
    {
      "published_at": "2024-12-17",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 10.0.12",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration versions 10.0.x ant\u00e9rieures \u00e0 10.0.11",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration versions 10.1.x ant\u00e9rieures \u00e0 10.1.3",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2024-AVI-0969",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-11-13T00:00:00.000000"
    },
    {
      "description": "Mise \u00e0 jour des produits affect\u00e9s",
      "revision_date": "2024-11-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Synacor Zimbra Collaboration. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": "2024-11-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 10.0.11",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11"
    },
    {
      "published_at": "2024-11-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 10.1.3",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.3"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration versions 10.1.x ant\u00e9rieures \u00e0 10.1.2",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration versions 10.0.x ant\u00e9rieures \u00e0 10.0.10",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration versions ant\u00e9rieures \u00e0 9.0.0 Patch 42",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2024-AVI-0850",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-10-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Synacor Zimbra Collaboration. Elle permet \u00e0 un attaquant de provoquer une injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF).",
  "title": "Vuln\u00e9rabilit\u00e9 dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": "2024-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=70713"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Daffodil versions ant\u00e9rieures \u00e0 10.1.1",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration Kepler versions ant\u00e9rieures \u00e0 9.0.0 Patch 41",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration Joule versions ant\u00e9rieures \u00e0 8.8.15 Patch 46",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration Daffodil versions ant\u00e9rieures \u00e0 10.0.9",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-45194",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45194"
    },
    {
      "name": "CVE-2024-38356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38356"
    },
    {
      "name": "CVE-2024-45513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45513"
    },
    {
      "name": "CVE-2024-45511",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45511"
    },
    {
      "name": "CVE-2024-45514",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45514"
    },
    {
      "name": "CVE-2024-45512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45512"
    },
    {
      "name": "CVE-2024-45516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45516"
    },
    {
      "name": "CVE-2024-45519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45519"
    },
    {
      "name": "CVE-2024-45515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45515"
    },
    {
      "name": "CVE-2024-45518",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45518"
    },
    {
      "name": "CVE-2024-45510",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45510"
    },
    {
      "name": "CVE-2024-45517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45517"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0742",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-09-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Synacor Zimbra Collaboration. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": "2024-09-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 8.8.15",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46"
    },
    {
      "published_at": "2024-09-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 10.0.9",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9"
    },
    {
      "published_at": "2024-09-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 9.0.0",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41"
    },
    {
      "published_at": "2024-09-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration 10.1.1",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration versions ant\u00e9rieures \u00e0 10.1.0",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2023-4863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4863"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0592",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Synacor Zimbra Collaboration. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": "2024-07-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor Zimbra Collaboration",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=70519"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration versions 10.x ant\u00e9rieures \u00e0 10.0.8",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration versions 9.x ant\u00e9rieures \u00e0 9.0.0 Patch 40",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-21708",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21708"
    },
    {
      "name": "CVE-2023-51764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51764"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0341",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-04-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Synacor Zimbra\nCollaboration. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me\nde s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, un contournement de la politique\nde s\u00e9curit\u00e9, une injection de code indirecte \u00e0 distance (XSS)\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Synacor Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Synacor du 22 avril 2024",
      "url": "https://wiki.zimbra.com/index.php?title=Zimbra_Security_Advisories\u0026oldid=70396"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration Daffodil versions ant\u00e9rieures \u00e0 10.0.7",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration Kepler versions ant\u00e9rieures \u00e0 9.0.0 Patch 39",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-41741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41741"
    },
    {
      "name": "CVE-2022-41742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41742"
    },
    {
      "name": "CVE-2024-27443",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27443"
    },
    {
      "name": "CVE-2024-27442",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27442"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0172",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-02-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Zimbra\nCollaboration. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Zimbra  Collaboration",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Zimbra 9.0.0 du 28 f\u00e9vrier 2024",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Zimbra 10.0.7 du 28 f\u00e9vrier 2024",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zimbra Collaboration Daffodil versions ant\u00e9rieures \u00e0 10.0.6",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration Kepler versions ant\u00e9rieures \u00e0 9.0.0 Patch 38",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    },
    {
      "description": "Zimbra Collaboration Joule versions ant\u00e9rieures \u00e0 8.8.15 Patch 45",
      "product": {
        "name": "Zimbra Collaboration",
        "vendor": {
          "name": "Synacor",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-48432",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48432"
    },
    {
      "name": "CVE-2023-50808",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50808"
    },
    {
      "name": "CVE-2022-21449",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-21449"
    },
    {
      "name": "CVE-2023-21930",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21930"
    },
    {
      "name": "CVE-2022-21476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-21476"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-1043",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-12-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Zimbra\nCollaboration. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me\nde s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des\ndonn\u00e9es et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Zimbra Collaboration",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Zimbra 9.0.0 du 18 d\u00e9cembre 2023",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P38"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Zimbra 10.0.6 du 18 d\u00e9cembre 2023",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.6"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Zimbra 8.8.15 du 18 d\u00e9cembre 2023",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P45"
    }
  ]
}