CVE-2020-13133

Tufin SecureChange (prior to R19.3 HF3 and R20-1 HF1) is vulnerable to stored XSS. Exploitation requires admin privileges to store the payload, and can be triggered by unauthenticated users. Affected TOS deployments include all versions before the cited fixes. Remediation: upgrade to R19.3 HF3 or...

CVE-2020-13134

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges for storing the XSS payload itself, and can exploit be triggered by admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1...

CVE-2020-13134

Tufin SecureChange is affected by stored XSS in all TOS deployments prior to R19.3 HF3 and R20-1 HF1. The vulnerability requires admin privileges to store the payload and can be triggered by admin users. Affected versions are fixed in R19.3 HF3 and R20-1 HF1; no exploitation details are provided ...

PT-2021-9563

Name of the Vulnerable Software and Affected Versions Tufin SecureChange versions prior to R19.3 HF3 Tufin SecureChange versions prior to R20-1 HF1 Description The issue is related to stored XSS, which can be exploited by unauthenticated users, but requires admin privileges to store the XSS...

PT-2021-9564

Name of the Vulnerable Software and Affected Versions Tufin SecureChange versions prior to R19.3 HF3 Tufin SecureChange versions prior to R20-1 HF1 Description The issue is related to stored XSS, which requires admin privileges for storing the XSS payload and can be triggered by admin users. All...

CVE-2020-13134: Improper Neutralization of Input During Web Page Generation

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges for storing the XSS payload itself, and can exploit be triggered by admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1...

CVE-2020-13133: Improper Neutralization of Input During Web Page Generation

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges for storing the XSS payload itself, and can exploit be triggered by unauthenticated users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and...

Tufin Securechange Cross-Site Scripting Vulnerability

Tufin Securechange is a network management software for enterprise environments from Tufin USA. A cross-site scripting vulnerability exists in Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1, which stems from a lack of proper validation of client-side data by the WEB application. An attacker...

Tufin Secure Change Remote Code Execution Exploit

Tufin SecureChange uses Richfaces version 4.3.5 which suffers from a remote code execution vulnerability. Product: Secure Change Vendor: Tufin Subject: Tufin SecureChange uses Richfaces 4.3.5, vulnerable to CVE-2015-0279 unauthenticated RCE CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H base score...

PT-2015-4559

Name of the Vulnerable Software and Affected Versions JBoss RichFaces versions prior to 4.5.4 Tufin SecureChange affected versions not specified Description The issue allows remote attackers to inject expression language EL expressions and execute arbitrary Java code. This can be achieved via the...