CVE-2023-45207

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. (This has been mitigated by sanitising the JavaScript code present in a PDF document.)

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-452088.8A command injection in the parsing_xml_stasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allo CVE-2023-452097.5An information disclosure vulnerability exists in the web interface /cgi-bin/download_config.cgi functionality of Peplink Smart Reader v1.2.CVE-2023-45219.8The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plug CVE-2023-452104.3Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view t CVE-2023-452136.5A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioni CVE-2023-452157.2A stack-based buffer overflow vulnerability exists in the boa setRepeaterSsid functionality of Realtek rtl819x Jungle SDK v3.4.11. A special CVE-2023-452177.8Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable esc CVE-2023-452194.4Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated at CVE-2023-45225.3An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 e CVE-2023-452208.8The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol t CVE-2023-452217.8Improper buffer restrictions in Intel(R) Media SDK all versions may allow an authenticated user to potentially enable escalation of privileg CVE-2023-452225.4An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-si