Security Vulnerabilities - CVEs Published In 2020
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182717.
CVSS Score
6.1
EPSS Score
0.007
Published
2020-08-10
IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score
6.1
EPSS Score
0.007
Published
2020-08-10
IBM Jazz Reporting Service 7.0 and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183039.
CVSS Score
6.1
EPSS Score
0.007
Published
2020-08-10
A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.
CVSS Score
7.5
EPSS Score
0.013
Published
2020-08-10
Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.
CVSS Score
7.4
EPSS Score
0.008
Published
2020-08-10
Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.
CVSS Score
6.8
EPSS Score
0.006
Published
2020-08-10
A security misconfiguration exists in Combodo iTop, which can expose sensitive information.
CVSS Score
7.5
EPSS Score
0.012
Published
2020-08-10
Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.
CVSS Score
5.7
EPSS Score
0.005
Published
2020-08-10
flatCore before 1.5.7 allows upload and execution of a .php file by an admin.
CVSS Score
7.2
EPSS Score
0.024
Published
2020-08-09
flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagename, prefs_pagetitle, or prefs_pagesubtitle parameter.
CVSS Score
4.8
EPSS Score
0.006
Published
2020-08-09