CVSS: 7.5EPSS: 89%CPEs: 36EXPL: 4CVE-2019-9621 – Zimbra < 8.8.11 - XML External Entity Injection / Server-Side Request Forgery
https://notcve.org/view.php?id=CVE-2019-9621
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. Zimbra Collaboration Suite anterior de la versión 8.6 path 13, versión 8.7.x anterior de la 8.7.11 path 10, y versión 8.8.x anterior de la 8.8.10 path 7 u versión 8.8.x anterior de la 8.8.11 path 3, permite vulnerabilidad de tipo SSRF por medio del componente ProxyServlet. Zimbra versions prior to 8.8.1 suffer from XML external entity injection and server-side request forgery vulnerabilities. • https://www.exploit-db.com/exploits/46967 https://www.exploit-db.com/exploits/46693 http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html https://blog.zimbra.com/2019/03/9826 https://bugzilla.zimbra. • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5721
https://notcve.org/view.php?id=CVE-2016-5721
Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidades de XSS en Zimbra Collaboration en versiones anteriores a 8.7.0 permite a atacantes remotos inyectar secuencia de comandos web o HTML a través de vectores no especificados. • http://www.securityfocus.com/bid/92682 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2015-6541 – Zimbra 8.0.9 GA - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2015-6541
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to service/soap/BatchRequest. Múltiples vulnerabilidades de CSRF en la inerfaz Mail en Zimbra Collaboration Server (ZCS) en versiones anteriores a 8.5 permiten a atacantes remotos secuestrar la autenticación de usuarios arbitrarios para peticiones que cambian preferencias de cuenta a través de una petición SOAP a service/soap/BatchRequest. • https://www.exploit-db.com/exploits/39500 http://seclists.org/fulldisclosure/2016/Feb/121 https://wiki.zimbra.com/wiki/Security/Collab/86#Notes_from_8.5_.28Jetty.29 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 0%CPEs: 19EXPL: 0CVE-2013-7217
https://notcve.org/view.php?id=CVE-2013-7217
Unspecified vulnerability in Zimbra Collaboration Server 7.2.5 and earlier, and 8.0.x through 8.0.5, has "critical" impact and unspecified vectors, a different vulnerability than CVE-2013-7091. Vulnerabilidad no especificada en Zimbra Collaboration Server 7.2.5 y anteriores, y 8.0.x hasta 8.0.5, con impacto "crítico" y vectores no especificados, una vulnerabilidad distinta a CVE-2013-7091. • http://bugzilla.zimbra.com/show_bug.cgi?id=84547 http://files.zimbra.com/website/docs/7.2/Zimbra_OS_Release_Notes_7.2.6.pdf http://files.zimbra.com/website/docs/8.0/Zimbra_OS_Release_Notes_8.0.6.pdf http://secunia.com/advisories/56138 http://www.osvdb.org/101147 http://www.securityfocus.com/bid/64415 http://www.zimbra.com/forums/announcements/67336-critical-security-vulnerability-addressed-7-2-6-8-0-6-maintenance-releases.html https://exchange.xforce.ibmcloud.com/vulner •