Vulnerabilities

TI-2019-13227 CVE-2019-18207 · GHSA-3c96-cx8m-c77h

In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject…

LOW 25

In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper validation of the Title field in the InfoBusiness Web Component.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00516 Published 2019-10-30 No fix listed CWE-79

TI-2019-13226 CVE-2019-18206 · GHSA-3gv3-3m2j-wpx7

A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and…

LOW 38

A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00457 Published 2019-10-30 No fix listed CWE-352

TI-2019-13225 CVE-2019-18205 · GHSA-qg48-gh7r-v9jq

Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti…

LOW 28

Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00668 Published 2019-10-30 No fix listed CWE-79

TI-2019-13224 CVE-2019-18204 · GHSA-4v8w-5cm8-f73w

Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload…

MEDIUM 42

Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve code execution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0173 Published 2019-10-30 No fix listed CWE-434

Vulnerabilities

Filters

In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject…

A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and…

Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti…

Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload…