CVE-2019-11318

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.zimbra.com/show_bug.cgi?id=109117Issue Tracking, Permissions Required, Vendor Advisory
https://wiki.zimbra.com/wiki/Security_CenterPatch, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.12/P1Patch, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
https://bugzilla.zimbra.com/show_bug.cgi?id=109117Issue Tracking, Permissions Required, Vendor Advisory
https://wiki.zimbra.com/wiki/Security_CenterPatch, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.12/P1Patch, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Timeline

Published: Jan 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-113199.8An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function downloadFirmware in hnap, which leads CVE-2019-11327.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k CVE-2019-113209.8In Motorola CX2 1.01 and M2 1.01, users can access the router's /priv_mgt.html web page to launch telnetd, as demonstrated by the 192.168.51 CVE-2019-113215.3An issue was discovered in Motorola CX2 1.01 and M2 1.01. The router opens TCP port 8010. Users can send hnap requests to this port without CVE-2019-113229.8An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function startRmtAssist in hnap, which leads t CVE-2019-113235.9HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is re CVE-2019-113247.5The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS stor CVE-2019-113259.8An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some CVE-2019-113268.8An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protecte CVE-2019-113274.9An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product has a local CVE-2019-113288.8An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could ex CVE-2019-11337.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulner