CVE-2023-37580

MediumCVSS 6.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 31, 2023
Last modified
Jun 17, 2026
Added to CISA KEV
Jul 27, 2023
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-375815.4Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache RolleCVE-2023-375829.8The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed inCVE-2023-37599.8A vulnerability, which was classified as critical, was found in Intergard SGS 8.7.0. Affected is an unknown function. The manipulation leadsCVE-2023-375968.1Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via a craftedCVE-2023-375978.1Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the deletCVE-2023-375984.5A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delCVE-2023-375997.5An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directoryCVE-2023-37606.5A vulnerability has been found in Intergard SGS 8.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionalCVE-2023-376006.1Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parametCVE-2023-376017.5Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts.CVE-2023-376026.1An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary CVE-2023-376055.5Weak Exception Handling vulnerability in baramundi software GmbH EMM Agent 23.1.50 and before allows an attacker to cause a denial of servic
CVE-2023-37580: Medium severity, CVSS 6.1 | Vulnix