Malware distributor Storm-0324 facilitates ransomware access

The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based initial infection vectors and then hand off access to compromised networks to other threat actors. These handoffs frequently lead to ransomware deployment. Beginnin...

The vulnerability of the Sage X3 business automation system, related to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Sage X3 enterprise automation system lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out cross-site scripting attacks using a specially created link...

CVE-2023-31868

Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting XSS. Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is...

CVE-2023-31868

Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting XSS. Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is...

CVE-2023-31867

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection...

CVE-2023-31868

Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting XSS. Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is...

CVE-2023-31867

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection...

CVE-2023-31867

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection...

Input validation

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection...

Cross site scripting

Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting XSS. Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is...

Sage Group Sage X3 安全漏洞

Sage Group Sage X3 is a software application from Sage Group UK. An enterprise resource planning product developed for mature organizations. A security vulnerability exists in Sage X3 version 12.14.0.50-0, which stems from vulnerability to CSV injection attacks...

CVE-2023-31867

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection...

CVE-2023-31868

Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting XSS. Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is...

CVE-2023-31868

CVE-2023-31868 concerns Sage X3 Web, version 12.14.0.50-0, with cross-site scripting (XSS) via unsanitized user input in parts of the web app that are dynamically built. The vulnerability is triggered when HTML/JavaScript code is injected into input fields that are not validated/filtered, and suc...

CVE-2023-31867

Sage X3 v12.14.0.50-0 is documented as vulnerable to CSV injection. The issue affects the Sage X3 software, with the root cause described in connected records as related to input validation (per PRION entry). The CVE entry notes CSV injection as the vulnerability, and Red Hat/CNNVD/NVD references...

Sage Group Sage X3 跨站脚本漏洞

Sage Group Sage X3 is a software application from Sage Group UK. An enterprise resource planning ERP product developed for mature organizations. A security vulnerability exists in Sage X3 version 12.14.0.50-0, which arises from the fact that portions of the web application are dynamically...

CVE-2023-31868

Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting XSS. Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is...

PT-2023-23497 · Sage · Sage X3

Name of the Vulnerable Software and Affected Versions: Sage X3 version 12.14.0.50-0 Description: The issue is related to CSV Injection. Recommendations: For Sage X3 version 12.14.0.50-0, at the moment, there is no information about a newer version that contains a fix for this issue...

CVE-2023-31867

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection...

CVE-2023-29927

Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a workstation setup in the "Windows Peer-to-Peer Network" or "Client Server Network" Sage 300 configurations, could recover the SQL connectio...