CVSS: 6.5EPSS: 0%CPEs: 28EXPL: 0CVE-2020-35123
https://notcve.org/view.php?id=CVE-2020-35123
In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17. En Zimbra Collaboration Suite Network Edition versiones anteriores a 9.0.0 P10 y versión 8.8.15 P17, se presenta una vulnerabilidad de tipo XXE en la extensión de la tienda de consumidores saml, que es vulnerable a ataques de tipo XXE. Esto ha sido corregido en la edición Zimbra Collaboration Suite Network versión 9.0.0 Parche 10 y 8.8.15 Parche 17 • https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P17 https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P10 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-15313
https://notcve.org/view.php?id=CVE-2019-15313
In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability. En Zimbra Collaboration versiones anteriores a 8.8.15 Patch 1, se presenta una vulnerabilidad de tipo XSS no persistente. • https://bugzilla.zimbra.com/show_bug.cgi?id=109141 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •