JVN#94169589: Multiple vulnerabilities in GROWI

GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below. Denial-of-service DoS due to improper verification of input values CWE-400 - CVE-2020-5682 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L| Base Score: 5.3 CVSS v2|...

Weseek GROWI 路径遍历漏洞

GROWI is a team collaboration software. A directory traversal vulnerability exists in WESEEK GROWI, which can be exploited by remote attackers to alter data by uploading specially crafted files...

CVE-2020-5677

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5677

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5678

Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5676

GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors...

CVE-2020-5678

Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5676

GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors...

Information disclosure

GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors...

Cross site scripting

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

Cross site scripting

Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5677

CVE-2020-5677 affects GROWI (WESEEK) prior to v4.1.5, with a reflected cross-site scripting vulnerability in versions

CVE-2020-5678

CVE-2020-5678 is a stored cross-site scripting vulnerability affecting GROWI up to v3.8.1 (and related CVEs cover other processed inputs). The connected sources confirm the issue is a stored XSS vulnerability in GROWI’s handling of POST requests/input processing, allowing remote attackers to inje...

CVE-2020-5677

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5678

Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5676

CVE-2020-5676 affects GROWI (WESEEK) v4.1.3 and earlier. It is described as an information-disclosure vulnerability where remote attackers may obtain information not allowed to access via unspecified vectors (CWE-200). The connected NVD/Veracode/Red Hat/JVN records corroborate the entry: informat...

CVE-2020-5676

GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors...

WESEEK GROWI Cross-Site Scripting Vulnerability

Weseek WESEEK GROWI is a suite of team collaboration software from the Japanese company WESEEK Weseek. A cross-site scripting vulnerability exists in GROWI versions 3.0.2 through 3.8.1. The vulnerability stems from a failure to adequately validate user-supplied data during the processing of a POS...

JVN#56450373: Multiple vulnerabilities in GROWI

GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below. Information disclosure CWE-200 - CVE-2020-5676 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N| Base Score: 5.3 CVSS v2| AV:N/AC:L/Au:N/C:P/I:N/A:N| Base Score: 5.0 Reflected...

WESEEK GROWI Cross-Site Scripting Vulnerability

Weseek WESEEK GROWI is a suite of team collaboration software from WESEEK Weseek Japan. GROWI suffers from a cross-site scripting vulnerability that arises from insufficient validation of user-supplied data. An attacker could trick a victim into following a specially crafted link and execute...