CVE-2022-45911

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary JavaScript, they will not get any sensitive information.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-459127.2An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authentic CVE-2022-459136.1An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via one of attributes in webmail URLs to execute arbitrary JavaScri CVE-2022-459146.5The ESL (Electronic Shelf Label) protocol, as implemented by (for example) the OV80e934802 RF transceiver on the ETAG-2130-V4.3 20190629 boa CVE-2022-459158.8ILIAS before 7.16 allows OS Command Injection.CVE-2022-459165.4ILIAS before 7.16 allows XSS.CVE-2022-459176.1ILIAS before 7.16 has an Open Redirect.CVE-2022-459186.5ILIAS before 7.16 allows External Control of File Name or Path.CVE-2022-459197.0An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there CVE-2022-45929.8A vulnerability was found in luckyshot CRMx and classified as critical. This issue affects the function get/save/delete/comment/commentdelet CVE-2022-459207.5In Softing uaToolkit Embedded before 1.41, a malformed CreateMonitoredItems request may cause a memory leak.CVE-2022-459217.5FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an a CVE-2022-459228.8An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The request handler for ll.KeepAliveSession sets a valid Adm