CVE-2020-11737

A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring (including the quotes) followed immediately by a DOM event listener such as onmouseover. This is fixed in 9.0.0 Patch 2.

• CWE-79

• https://blog.zimbra.com/2020/05/new-zimbra-9-kepler-patch-2/Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P2Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
• https://blog.zimbra.com/2020/05/new-zimbra-9-kepler-patch-2/Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P2Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Published

May 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11731The Media Library Assistant plugin before 2.82 for Wordpress…6.1
• CVE-2020-11732The Media Library Assistant plugin before 2.82 for Wordpress…7.5
• CVE-2020-11733An issue was discovered on Spirent TestCenter and Avalanche …6.7
• CVE-2020-11734cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS…6.1
• CVE-2020-11735The private-key operations in ecc.c in wolfSSL before 4.4.0 …5.3
• CVE-2020-11736fr-archive-libarchive.c in GNOME file-roller through 3.36.1 …3.9
• CVE-2020-11738The Snap Creek Duplicator plugin before 1.3.28 for WordPress…7.5
• CVE-2020-11739An issue was discovered in Xen through 4.13.x, allowing gues…7.8
• CVE-2020-1174A remote code execution vulnerability exists when the Window…7.8
• CVE-2020-11740An issue was discovered in xenoprof in Xen through 4.13.x, a…5.5
• CVE-2020-11741An issue was discovered in xenoprof in Xen through 4.13.x, a…8.8
• CVE-2020-11742An issue was discovered in Xen through 4.13.x, allowing gues…5.5