CVE-2021-35208

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

• CWE-79

• https://blog.sonarsource.com/zimbra-webmail-compromise-via-emailExploit, Mitigation, Third Party Advisory
• https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
• https://blog.sonarsource.com/zimbra-webmail-compromise-via-emailExploit, Mitigation, Third Party Advisory
• https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Published

Jul 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35202NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authoriz…4.3
• CVE-2021-35203NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrar…5.7
• CVE-2021-35204NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflecte…5.4
• CVE-2021-35205NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows …5.4
• CVE-2021-35206Gitpod before 0.6.0 allows unvalidated redirects.6.1
• CVE-2021-35207An issue was discovered in Zimbra Collaboration Suite 8.8 be…6.1
• CVE-2021-35209An issue was discovered in ProxyServlet.java in the /proxy s…9.8
• CVE-2021-3521There is a flaw in RPM's signature functionality. OpenPGP su…4.7
• CVE-2021-35210Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through…6.1
• CVE-2021-35211Microsoft discovered a remote code execution (RCE) vulnerabi…10
• CVE-2021-35212An SQL injection Privilege Escalation Vulnerability was disc…8.8
• CVE-2021-35213An Improper Access Control Privilege Escalation Vulnerabilit…8.8