CVE-2018-17938

Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.

• CWE-345

• https://bugzilla.zimbra.com/show_bug.cgi?id=109021Permissions Required, Third Party Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.10Release Notes, Vendor Advisory
• https://bugzilla.zimbra.com/show_bug.cgi?id=109021Permissions Required, Third Party Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.10Release Notes, Vendor Advisory

Published

Oct 3, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17932JUUKO K-800 (Firmware versions prior to numbers ending ...9A…9.8
• CVE-2018-17933VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versi…
• CVE-2018-17934NUUO CMS All versions 3.3 and prior the application allows e…
• CVE-2018-17935All versions of Telecrane F25 Series Radio Controls before 0…8.1
• CVE-2018-17936NUUO CMS All versions 3.3 and prior the application allows t…
• CVE-2018-17937gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3…8.8
• CVE-2018-17939An issue was discovered in GitLab Community and Enterprise E…
• CVE-2018-1794IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 usin…6.1
• CVE-2018-17942The convert_to_decimal function in vasnprintf.c in Gnulib be…
• CVE-2018-17944On certain Lexmark devices that communicate with an LDAP or …
• CVE-2018-17946The Tribulant Slideshow Gallery plugin before 1.6.6.1 for Wo…
• CVE-2018-17947The Snazzy Maps plugin before 1.1.5 for WordPress has XSS vi…