{"id":"CVE-2018-14013","aliases":["EUVD-2018-5944","GHSA-437w-56m7-gqfx"],"status":"published","title":"Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web...","description":"Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07436,"percentile":0.94489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2019-05-29T21:24:02Z","modified":"2026-10-24T10:30:50Z","exploits":[{"source":"nuclei","id":"CVE-2018-14013","title":"Synacor Zimbra Collaboration Suite Collaboration \u003c8.8.11 - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14013.yaml"}],"products":[{"vendor":"synacor","product":"zimbra_collaboration_suite"}],"references":[{"url":"http://packetstormsecurity.com/files/151472/Zimbra-Collaboration-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://seclists.org/fulldisclosure/2019/Feb/3","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"http://www.openwall.com/lists/oss-security/2019/01/30/1","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","evidence"]},{"url":"http://www.securityfocus.com/bid/106787","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.zimbra.com/show_bug.cgi?id=109018","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://bugzilla.zimbra.com/show_bug.cgi?id=109017","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14013"},{"url":"https://github.com/advisories/GHSA-437w-56m7-gqfx"}],"sources":{"cve":[{"id":"CVE-2018-14013","description":"Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.","status":"published","published":"2019-05-29T21:24:02Z","modified":"2024-08-05T09:21:40.762Z","updated_at":"2026-11-02T14:35:00.589142Z"}],"euvd":[{"id":"EUVD-2018-5944","description":"Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.","status":"published","published":"2019-05-29T21:24:02Z","modified":"2024-08-05T09:21:40Z","updated_at":"2026-11-03T02:39:47.770292Z"}],"ghsa":[{"id":"GHSA-437w-56m7-gqfx","title":"Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web...","description":"Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.","status":"published","published":"2022-05-24T16:46:52Z","modified":"2024-04-04T00:49:35Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:55:52.162148Z"}],"nvd":[{"id":"CVE-2018-14013","description":"Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.","status":"published","published":"2019-05-29T22:29:00.883Z","modified":"2026-06-17T01:40:29.227Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:57.307075Z"}],"osv":[{"id":"CVE-2018-14013","description":"Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.","status":"published","published":"2019-05-29T22:29:00.883Z","modified":"2026-10-24T10:30:50.787977965Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.242347Z"}]}}