CVSS: 4.0EPSS: 0%CPEs: 2EXPL: 0CVE-2017-20191 – Zimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scripting
https://notcve.org/view.php?id=CVE-2017-20191
A vulnerability was found in Zimbra zm-admin-ajax up to 8.8.1. It has been classified as problematic. This affects the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js of the component Form Textbox Field Error Handler. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. • https://github.com/Zimbra/zm-admin-ajax/commit/bb240ce0c71c01caabaa43eed30c78ba8d7d3591 https://github.com/Zimbra/zm-admin-ajax/releases/tag/8.8.2 https://vuldb.com/?ctiid.258621 https://vuldb.com/?id.258621 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 0CVE-2017-20188 – Zimbra zm-ajax XFormItem.js XFormItem.prototype.setError cross site scripting
https://notcve.org/view.php?id=CVE-2017-20188
A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. • https://github.com/Zimbra/zm-ajax/commit/8d039d6efe80780adc40c6f670c06d21de272105 https://github.com/Zimbra/zm-ajax/releases/tag/8.8.2 https://vuldb.com/?ctiid.249421 https://vuldb.com/?id.249421 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •