EUVD-2017-7939

Malware in sbrugna...

EUVD-2017-7938

Malware in sbrugna...

Cross site request forgery (csrf)

An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account...

Cross site scripting

An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked...

CVE-2017-16755

An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked...

CVE-2017-16756

CVE-2017-16756 affects Userscape HelpSpot before 4.7.2. A CSRF weakness on POST requests to index.php?pg=password.change allows an attacker to change another user’s password. Impact: credential change without authorization. Remediation: upgrade to HelpSpot 4.7.2 or later (per cited disclosures). ...

CVE-2017-16755

An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked...

CVE-2017-16756

An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account...

CVE-2017-16755

Affected software : Userscape HelpSpot

CVE-2017-16755: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked...

CVE-2017-16756: Cross-Site Request Forgery (CSRF)

An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account...