Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 61
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:* | 8.8.15 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:* | 8.8.15 p1 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:* | 8.8.15 p10 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:* | 8.8.15 p11 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:* | 8.8.15 p12 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:* | 8.8.15 p13 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:* | 8.8.15 p14 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:* | 8.8.15 p15 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:* | 8.8.15 p16 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:* | 8.8.15 p17 | Vulnerable | Synacor |
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:* Versions 8.8.15 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:* Versions 8.8.15 p1 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:* Versions 8.8.15 p10 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:* Versions 8.8.15 p11 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:* Versions 8.8.15 p12 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:* Versions 8.8.15 p13 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:* Versions 8.8.15 p14 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:* Versions 8.8.15 p15 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:* Versions 8.8.15 p16 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:* Versions 8.8.15 p17 Vulnerable ·Synacor
Show 51 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:* | 8.8.15 p18 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:* | 8.8.15 p19 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:* | 8.8.15 p2 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:* | 8.8.15 p20 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:* | 8.8.15 p21 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:* | 8.8.15 p22 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:* | 8.8.15 p23 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:* | 8.8.15 p24 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:* | 8.8.15 p25 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:* | 8.8.15 p26 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:* | 8.8.15 p27 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:* | 8.8.15 p28 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:* | 8.8.15 p29 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:* | 8.8.15 p3 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:* | 8.8.15 p30 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:* | 8.8.15 p31 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:* | 8.8.15 p31.1 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:* | 8.8.15 p32 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:* | 8.8.15 p4 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:* | 8.8.15 p5 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:* | 8.8.15 p6 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:* | 8.8.15 p7 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:* | 8.8.15 p8 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:* | 8.8.15 p9 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:* | 9.0.0 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:* | 9.0.0 p1 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:* | 9.0.0 p10 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:* | 9.0.0 p11 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:* | 9.0.0 p12 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:* | 9.0.0 p13 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:* | 9.0.0 p14 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:* | 9.0.0 p15 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:* | 9.0.0 p16 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:* | 9.0.0 p17 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:* | 9.0.0 p18 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:* | 9.0.0 p19 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:* | 9.0.0 p2 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:* | 9.0.0 p20 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:* | 9.0.0 p21 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:* | 9.0.0 p22 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:* | 9.0.0 p23 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:* | 9.0.0 p24 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:* | 9.0.0 p24.1 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:* | 9.0.0 p25 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:* | 9.0.0 p3 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:* | 9.0.0 p4 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:* | 9.0.0 p5 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:* | 9.0.0 p6 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:* | 9.0.0 p7 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:* | 9.0.0 p8 | Vulnerable | Synacor |
| cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:* | 9.0.0 p9 | Vulnerable | Synacor |
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:* Versions 8.8.15 p18 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:* Versions 8.8.15 p19 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:* Versions 8.8.15 p2 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:* Versions 8.8.15 p20 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:* Versions 8.8.15 p21 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:* Versions 8.8.15 p22 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:* Versions 8.8.15 p23 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:* Versions 8.8.15 p24 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:* Versions 8.8.15 p25 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:* Versions 8.8.15 p26 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:* Versions 8.8.15 p27 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:* Versions 8.8.15 p28 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:* Versions 8.8.15 p29 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:* Versions 8.8.15 p3 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:* Versions 8.8.15 p30 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:* Versions 8.8.15 p31 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:* Versions 8.8.15 p31.1 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:* Versions 8.8.15 p32 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:* Versions 8.8.15 p4 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:* Versions 8.8.15 p5 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:* Versions 8.8.15 p6 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:* Versions 8.8.15 p7 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:* Versions 8.8.15 p8 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:* Versions 8.8.15 p9 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:* Versions 9.0.0 p1 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:* Versions 9.0.0 p10 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:* Versions 9.0.0 p11 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:* Versions 9.0.0 p12 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:* Versions 9.0.0 p13 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:* Versions 9.0.0 p14 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:* Versions 9.0.0 p15 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:* Versions 9.0.0 p16 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:* Versions 9.0.0 p17 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:* Versions 9.0.0 p18 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:* Versions 9.0.0 p19 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:* Versions 9.0.0 p2 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:* Versions 9.0.0 p20 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:* Versions 9.0.0 p21 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:* Versions 9.0.0 p22 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:* Versions 9.0.0 p23 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:* Versions 9.0.0 p24 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:* Versions 9.0.0 p24.1 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:* Versions 9.0.0 p25 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:* Versions 9.0.0 p3 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:* Versions 9.0.0 p4 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:* Versions 9.0.0 p5 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:* Versions 9.0.0 p6 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:* Versions 9.0.0 p7 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:* Versions 9.0.0 p8 Vulnerable ·Synacor
- cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:* Versions 9.0.0 p9 Vulnerable ·Synacor
Remediation
No fixed version listed by the sources yet.
Timeline
- 2022-08-11 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2022-37042
- 2026-10-03 Alias added: GHSA-9g5r-3vrr-xfcm
References
More Synacor Zimbra Collaboration Suite vulnerabilities
- TI-2024-30554 The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before… KEVCVSS 3.1CRITICAL 10.0
- TI-2022-19841 An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. KEVCVSS 3.1CRITICAL 9.8
- TI-2022-10792 Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-06312 Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is… KEVCVSS 3.1CRITICAL 9.8
- TI-2019-07076 mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-51660 OS command injection in Zimbra Collaboration KEVCVSS 3.1HIGH 8.9
Sources
- CVE-2022-37042 · CVE Program
- CVE-2022-37042 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-9g5r-3vrr-xfcm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences