CVE-2024-41640

描述 AML Surety Eco 版本 3.5 及更早版本受一个未经认证的反射型跨站脚本漏洞影响。 目标 Web 应用在专用错误页面中处理错误（无需任何认证即可访问），该页面包含一个 URL 参数，未对用户输入进行清理。所提供的参数值被 Web 应用直接反射，导致恶意 payload 在受害者的浏览器中执行 JavaScript 代码。 风险 严重性：中危 CVSS v3.1 分数：5.4 CVSS v3.1 向量：AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L 受影响资源 版本：AML Surety Eco v3.5 及更早版本...

CVE-2024-41640

Cross Site Scripting XSS vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter...

CVE-2024-41640

Cross Site Scripting XSS vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter...

PT-2024-29475 · Unknown · Aml Surety Eco

Name of the Vulnerable Software and Affected Versions: AML Surety Eco versions up to 3.5 Description: The issue allows an attacker to run arbitrary code via a crafted GET request using the id parameter. This is a Cross Site Scripting XSS issue. Recommendations: For AML Surety Eco versions up to...

CVE-2024-41640

Cross Site Scripting XSS vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter...

CVE-2024-41640

CVE-2024-41640 documents confirm a Cross Site Scripting (XSS) vulnerability in AML Surety Eco, affected up to version 3.5. The vulnerability arises from the use of the id parameter in a crafted GET request, enabling an attacker to run arbitrary code. The connected sources consistently describe XS...

CVE-2024-41640

Cross Site Scripting XSS vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter...