CVE-2020-13412: Cross-Site Request Forgery (CSRF)

An issue was discovered in Aviatrix Controller before 5.4.1204. An API call on the web interface lacked a session token check to control access, leading to CSRF...

CVE-2020-13414: Use of Hard-coded Credentials

An issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by the software...

CVE-2020-13416: Cross-Site Request Forgery (CSRF)

An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens the application up to a Cross Site Request Forgery CSRF vulnerability for password resets...