Vulnerabilities

TI-2024-26288 CVE-2024-39332 · GHSA-635w-qqhj-gvhx

Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve…

HIGH 82

Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execution via modification of shell scripts on the server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01275 Published 2024-10-31 No fix listed CWE-22

TI-2022-15704 CVE-2022-34914 · GHSA-38x3-v328-497c

Webswing before 22.1.3 allows X-Forwarded-For header injection.

MEDIUM 44

Webswing before 22.1.3 allows X-Forwarded-For header injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01074 Published 2022-07-08 No fix listed CWE-74

TI-2020-08976 CVE-2020-11103 · GHSA-6vx9-m878-j4x6

JsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution.

MEDIUM 47

JsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02873 Published 2020-12-30 No fix listed

Vulnerabilities

Filters

Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve…

Webswing before 22.1.3 allows X-Forwarded-For header injection.

JsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution.