PT-2018-17760

Name of the Vulnerable Software and Affected Versions Cozy version 2 Description The issue allows remote attackers to obtain administrative access via JavaScript code in the url parameter to the "/api/proxy" API endpoint. This can be achieved through an XMLHttpRequest call with a request containi...

CVE-2018-6824: Improper Neutralization of Input During Web Page Generation

Cozy version 2 has XSS allowing remote attackers to obtain administrative access via JavaScript code in the url parameter to the /api/proxy URI, as demonstrated by an XMLHttpRequest call with an 'email:"[email protected]"' request, which can be followed by a password reset...