32 matches found
CVE-2019-20154
An issue was discovered in Determine formerly Selectica Contract Lifecycle Management CLM v5.4. A cross-site scripting XSS vulnerability in multiple getchart.jsp parameters allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-20153
An issue was discovered in Determine formerly Selectica Contract Lifecycle Management CLM in v5.4. An XML external entity XXE vulnerability in the upload definition feature in definitionuploadattach.jsp allows authenticated remote attackers to read arbitrary files including configuration files...
Code injection
An issue was discovered in reportedit.jsp in Determine formerly Selectica Contract Lifecycle Management CLM v5.4. Any authenticated user may execute Groovy code when generating a report, resulting in arbitrary code execution on the underlying server...
Cross site scripting
An issue was discovered in Determine formerly Selectica Contract Lifecycle Management CLM v5.4. A cross-site scripting XSS vulnerability in multiple getchart.jsp parameters allows remote attackers to inject arbitrary web script or HTML...
CVE-2019-20155
CVE-2019-20155 affects Determine CLM v5.4 (report_edit.jsp). The issue allows an authenticated user to cause Groovy code execution on the server during report generation, enabling arbitrary code execution. Affected component is the report generation flow in report_edit.jsp; root cause is code exe...
CVE-2019-20154
Determine Contract Lifecycle Management (CLM) v5.4 contains a Cross‑Site Scripting (XSS) vulnerability in multiple getchart.jsp parameters, enabling remote attackers to inject arbitrary web script or HTML. The affected component is CLM 5.4; root cause stems from inadequate input validation in get...
CVE-2019-20153
CVE-2019-20153 concerns Determine Contract Lifecycle Management (CLM) v5.4, where an XML External Entity (XXE) flaw in the upload definition feature (definition_upload_attach.jsp) allows authenticated remote attackers to read arbitrary files, including configuration files with administrative cred...
Determine Contract Lifecycle Management Cross-Site Scripting Vulnerability
Determine Contract Lifecycle Management CLM is a suite of enterprise contract lifecycle management solutions from Determine Corporation. A cross-site scripting vulnerability exists in the getchart.jsp file in Determine CLM version 5.4, which stems from the lack of proper validation of client-side...
Determine Contract Lifecycle Management Input Validation Error Vulnerability
Determine Contract Lifecycle Management CLM is a suite of enterprise contract lifecycle management solutions from Determine Corporation. An input validation error vulnerability in the reportedit.jsp file in Determine CLM v5.4 can be exploited by an attacker to execute arbitrary code on this...
Determine Contract Lifecycle Management XML External Entity Injection Vulnerability
Determine Contract Lifecycle Management CLM is a suite of enterprise contract lifecycle management solutions from Determine Corporation. An XML external entity injection vulnerability exists in the definitionuploadattach.jsp file in Determine CLM version 5.4, which can be exploited by an attacker...
