PT-2020-14684

Name of the Vulnerable Software and Affected Versions MunkiReport versions prior to 2.6 Description A Cross-Site Scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the last two URL parameters, which report installed packages names and versions...

CVE-2020-15883: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters through which installed packages names and versions are reported...

PT-2020-14687

Name of the Vulnerable Software and Affected Versions MunkiReport versions prior to 3.5 Description A SQL injection issue in the reportdata module allows attackers to execute arbitrary SQL commands. This is achieved by manipulating the req parameter of the "/module/reportdata/ip" endpoint...

PT-2020-14682

Name of the Vulnerable Software and Affected Versions MunkiReport versions prior to 1.5 Description A Cross-Site Scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is due to a vulnerability in the munki facts module, also known as Munki Conditions...

PT-2020-14685

Name of the Vulnerable Software and Affected Versions MunkiReport versions prior to 5.6.3 Description A SQL injection issue allows attackers to execute arbitrary SQL commands. This is achieved via the order0dir field on POST requests to the "/datatables/data" API endpoint. Recommendations For...

CVE-2020-15884: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order0dir field on POST requests to /datatables/data...

CVE-2020-15887: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in softwareupdatecontroller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/gettabdata/ endpoint...

PT-2020-14683

Name of the Vulnerable Software and Affected Versions MunkiReport versions prior to 5.6.3 Description A CSRF issue in the "manager/delete machine/id" endpoint allows attackers to delete arbitrary machines from the MunkiReport database. Recommendations For versions prior to 5.6.3, update to versio...

CVE-2020-15885: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment...

Munkireport Cross-Site Scripting Vulnerability (CNVD-2020-16631)

Munkireport is a reporting client for munki. A cross-site scripting vulnerability exists in Munkireport versions prior to 5.3.0. An attacker can exploit this vulnerability by injecting javascript into the comment field via the /module/comment/save endpoint...

Munkireport Cross-Site Scripting Vulnerability

Munkireport is a reporting client for munki. A cross-site scripting vulnerability exists in Munkireport versions prior to 5.3.0. An attacker can exploit this vulnerability to inject javascript into the MunkiReport database via the /report/brokenclient endpoint...

MunkiReport SQL Injection Vulnerability

Munkireport is a reporting client for munki. A SQL injection vulnerability exists in app/models/tablequery.php in Munkireport versions prior to 5.3.0. An attacker can exploit this vulnerability to inject arbitrary SQL into webquery via the /datatables/data endpoint...

CVE-2020-10191

An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/controllers/client.php:detail...

CVE-2020-10192

An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/brokenclient endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/views/listings/default.php...

CVE-2020-10191

An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/controllers/client.php:detail...

CVE-2020-10192

An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/brokenclient endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/views/listings/default.php...

CVE-2020-10190

An issue was discovered in MunkiReport before 5.3.0. An authenticated user could achieve SQL Injection in app/models/tablequery.php by crafting a special payload on the /datatables/data endpoint...

Design/Logic Flaw

An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/brokenclient endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/views/listings/default.php...

Sql injection

An issue was discovered in MunkiReport before 5.3.0. An authenticated user could achieve SQL Injection in app/models/tablequery.php by crafting a special payload on the /datatables/data endpoint...

CVE-2020-10190

CVE-2020-10190 concerns MunkiReport prior to version 5.3.0, where an authenticated user can trigger an SQL Injection through the endpoint /datatables/data by crafting a special payload in the vulnerable script app/models/tablequery.php. The connected sources corroborate the vulnerability, listing...