CVE-2024-45510

An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. Zimbra Webmail (Modern UI) is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper sanitization of user input. This allows an attacker to inject malicious code into specific fields of an e-mail message. When the victim adds the attacker to their contacts, the malicious code is stored and executed when viewing the contact list. This can lead to unauthorized actions such as arbitrary mail sending, mailbox exfiltration, profile picture alteration, and other malicious actions. Proper sanitization and escaping of input fields are necessary to mitigate this vulnerability.

• CWE-79

• https://wiki.zimbra.com/wiki/Security_CenterVendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_FixesRelease Notes
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_FixesRelease Notes
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_FixesRelease Notes
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyProduct

Published

Nov 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45505Improper Neutralization of Special Elements used in a Comman…8.8
• CVE-2024-45506HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x t…7.5
• CVE-2024-45507Server-Side Request Forgery (SSRF), Improper Control of Gene…9.8
• CVE-2024-45508HTMLDOC before 1.9.19 has an out-of-bounds write in parse_pa…9.8
• CVE-2024-45509In MISP through 2.4.196, app/Controller/BookmarksController.…6.5
• CVE-2024-4551The Video Gallery – YouTube Playlist, Channel Gallery by Yot…8.8
• CVE-2024-45511An issue was discovered in Zimbra Collaboration (ZCS) throug…5.4
• CVE-2024-45512An issue was discovered in webmail in Zimbra Collaboration (…5.4
• CVE-2024-45513An issue was discovered in Zimbra Collaboration (ZCS) throug…4.8
• CVE-2024-45514An issue was discovered in Zimbra Collaboration (ZCS) throug…5.4
• CVE-2024-45515An issue was discovered in Zimbra Collaboration (ZCS) throug…6.1
• CVE-2024-45516An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 …6.1