CVE-2020-14987

An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows remote attackers to execute arbitrary code because there is a mishandling of the capability for administrators to write and run Groovy scripts within the updater editor. An attacker must use an AST...

CVE-2020-14987

CVE-2020-14987 affects Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. The issue arises from mishandling of the capability for administrators to write and run Groovy scripts within the updater editor, enabling remote code execution if an attacker can leverage an AST transforming annota...

CVE-2020-14988: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the...

PT-2021-9731

Name of the Vulnerable Software and Affected Versions Bloomreach Experience Manager brXM versions 4.1.0 through 14.2.2 Description An issue was discovered that allows CSRF if the attacker uses GET where POST was intended. Recommendations For versions 4.1.0 through 14.2.2, consider implementing...

CVE-2020-14989: Cross-Site Request Forgery (CSRF)

An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows CSRF if the attacker uses GET where POST was intended...

PT-2021-9730

Name of the Vulnerable Software and Affected Versions Bloomreach Experience Manager brXM versions 4.1.0 through 14.2.2 Description The issue allows for cross-site scripting XSS attacks in various components of the software. Specifically, XSS is possible via the loginmessage parameter in the login...

PT-2021-9729

Name of the Vulnerable Software and Affected Versions Bloomreach Experience Manager brXM versions 4.1.0 through 14.2.2 Description An issue in the Bloomreach Experience Manager allows remote attackers to execute arbitrary code due to a mishandling of the capability for administrators to write and...

CVE-2020-14987: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows remote attackers to execute arbitrary code because there is a mishandling of the capability for administrators to write and run Groovy scripts within the updater editor. An attacker must use an AST...

Bloomreach Experience Manager 安全漏洞

Bloomreach Experience Manager is an application from Bloomreach USA. which provides AI-driven search and merchandising tools. A security vulnerability exists in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2, which originates from a vulnerability that could allow a remote attacker to...

Bloomreach Experience Manager 跨站脚本漏洞

Bloomreach Experience Manager is an application from Bloomreach USA. which provides AI-driven search and merchandising tools. A cross-site scripting vulnerability exists in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2, which stems from the loginmessage parameter allowing XSS in the log...

Bloomreach Experience Manager 跨站请求伪造漏洞

Bloomreach Experience Manager is an application from Bloomreach USA. which provides AI-driven search and merchandising tools. Bloomreach Experience Manager brXM 4.1.0 through 14.2.2 suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to CSRF...

bloomreach.com XSS vulnerability

Open Bug Bounty ID: OBB-440762 Description| Value ---|--- Affected Website:| bloomreach.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...