PT-2023-14300 · Gx · Xperiencentral

Name of the Vulnerable Software and Affected Versions: GX Software XperienCentral versions 10.36.0 and earlier Description: The issue allows unauthorized users to post data to the server by sending POST requests to the /web/mvc endpoint if they can bypass other security filters. Recommendations:...

PT-2023-14298 · Gx · Xperiencentral

Name of the Vulnerable Software and Affected Versions: GX Software XperienCentral versions 10.31.0 through 10.33.0 Description: The issue allows for cross-site request forgery CSRF due to the unique token being deducible from the names of all input fields. Recommendations: For GX Software...

GX Software XperienCentral 安全漏洞

GX Software XperienCentral is a CMS from GX Software. A security vulnerability exists in GX Software XperienCentral version 10.36.0 and prior versions, which stems from a vulnerability that allows an unauthorized attacker to bypass security filters and place unauthorized data on the server...

CVE-2022-43711

Interactive Forms IAF in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks XSS because the CSP header uses eval in the script-src...

CVE-2022-43711

Interactive Forms IAF in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks XSS because the CSP header uses eval in the script-src...

CVE-2022-43713

Interactive Forms IAF in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validation could be bypassed...

CVE-2022-43713

GX Software XperienCentral has an IAF validation bypass vulnerability (CVE-2022-43713) affecting versions 10.33.1 through 10.35.0, allowing invalid data input via Interactive Forms. The issue stems from bypassable form validation in IAF. Impact is mainly data integrity for inputs; CVSS indicates ...

CVE-2022-43710

Interactive Forms IAF in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery CSRF because the unique token could be deduced using the names of all input fields...

GX Software XperienCentral 输入验证错误漏洞

GX Software XperienCentral is a CMS from GX Software. A security vulnerability exists in GX Software XperienCentral versions 10.33.1 through 10.35.0, which stems from an easy bypass of the validation of Interactive Forms IAF...

CVE-2022-43712

POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965...

CVE-2022-43712

GX Software XperienCentral 10.36.0 and earlier is affected by CVE-2022-22965 (Spring4Shell) via data binding in Spring MVC/WebFlux on Java 9+. An attacker able to reach a vulnerable WAR/deployed app could achieve remote code execution. Root cause: unsafe data binding in Spring Framework modules; ...

CVE-2022-43710

CVE-2022-43710 affects GX Software XperienCentral, versions 10.31.0 through 10.33.0. The vulnerability is a cross-site request forgery (CSRF) where the unique token can be deduced from the names of all input fields. The impact is CSRF exploitation risk as described in multiple sources. No exploit...