PT-2025-7474 · Wss Agent +1 · Wss Agent +1

Name of the Vulnerable Software and Affected Versions: Symantec Diagnostic Tool SymDiag versions prior to 3.0.79 Description: The issue is a Privilege Escalation vulnerability that may affect Symantec Diagnostic Tool SymDiag. It is only applicable to the combination of SymDiag and the WSS Agent...

SUSE CVE-2016-5137

The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy CSP implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs,...

GO-2022-0370 Man-in-the-middle attack due to improper validation of certificate in mellium.im/xmpp

Websocket client connections are vulnerable to man-in-the-middle attacks via DNS spoofing. When looking up a WSS endpoint using a DNS TXT record, the server TLS certificate is incorrectly validated using the name of the server returned by the TXT record request, not the name of the the server bei...

Microsoft DFSCoerce Domain Control Privilege Vulnerability

Windows Server is a server operating system for Windows introduced by Microsoft on April 24, 2003, with the Microsoft Windows Server System WSS at its core. Microsoft DFSCoerce has a domain control privilege exploit, which can be exploited by an attacker to request the certificate of a domain...

wss-plugin (1.1.0) potentially affected by CVE-2020-22083 via jsonpickle (0.7.2)

jsonpickle PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on jsonpickle and may be impacted: - wss-plugin 1.1.0 Source cves: CVE-2020-22083 Source advisory: OSV:GHSA-J66Q-QMRC-89RX...

jaraco-modb (3.5.1), mgquant (3.1.0) +4 more potentially affected by CVE-2020-22083 via jsonpickle (0.9.4)

jsonpickle PYPI version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on jsonpickle and may be impacted: - jaraco-modb 3.5.1 - mgquant 3.1.0 - playback-studio 0.3.30 - rqalpha 0.3.0 - wss-plugin =1.1.1, =19.2.1 - wssplugin-integration 1.1.1 Source...

Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket

Impact If no TLS configuration is provided by the user, the websocket package constructs its own TLS configuration using recommended defaults. When looking up a WSS endpoint using the DNS TXT record method described in XEP-0156: Discovering Alternative XMPP Connection Methods the ServerName field...

CVE-2020-20471

White Shark System WSS 1.3.2 has an unauthorized access vulnerability in defaultuseredit.php, remote attackers can exploit this vulnerability to escalate to admin privileges...

Information disclosure

White Shark System WSS 1.3.2 has a sensitive information disclosure vulnerability. The ifgetaddbook.php file does not have an authentication operation. Remote attackers can obtain username information for all users of the current site...

CVE-2020-20468

White Shark System WSS 1.3.2 is vulnerable to CSRF. Attackers can use the usereditpassword.php file to modify the user password...

CVE-2020-20474

Vulnerability summary (CVE-2020-20474): White Shark System (WSS) version 1.3.2 contains an SQL injection due to inadequate filtering of the csa_to_user parameter in default_task_edituser.php. This allows remote attackers to potentially retrieve sensitive database information. The connected docume...

CVE-2020-20473

CVE-2020-20473 affects White Shark System (WSS) 1.3.2. Root cause: unsanitized sort parameter in control_task.php, control_project.php, and default_user.php leading to SQL injection. Remote attackers could obtain sensitive database information. Multiple sources (Red Hat, CNVD, NVD, CVE records) c...

CVE-2020-20472

CVE-2020-20472 affects White Shark System (WSS) 1.3.2. The vulnerability is in if_get_addbook.php, which operates without authentication, allowing remote attackers to obtain username information for all users on the current site. The condition arises from lack of access control on that endpoint (...

CVE-2020-20471

CVE-2020-20471 affects White Shark System (WSS) 1.3.2. The vulnerability is in default_user_edit.php and allows unauthorized access with privilege escalation to administrator by remote attackers. CVSS details indicate high impact on confidentiality, integrity, and availability (base score 8.8 / h...

CVE-2020-20470

CVE-2020-20470 affects White Shark System (WSS) 1.3.2. The issue is described as a website physical path leakage/disclosure vulnerability in WSS 1.3.2, with NVD metrics showing a medium base score (CVSS 2.0: 5.0; CVSS 3.1: 5.3) and network attack vector with low complexity. Connected sources cons...

CVE-2020-20469

White Shark System (WSS) 1.3.2 contains a SQL injection in log_edit.php caused by an unfiltered csa_to_user parameter, allowing remote attackers to access sensitive database information. Evidence from CVE entries (CVE-2020-20469) and CNVD/Red Hat/PRION mirrors confirms the vulnerability is trigge...

CVE-2020-20468

White Shark System (WSS) 1.3.2 is affected by CVE-2020-20468, a CSRF vulnerability that allows an attacker to modify a user password via the file user_edit_password.php. The issue is documented in multiple sources (CNVD/CNNVD) as a Cross-Site Request Forgery vulnerability in WSS, enabling passwor...

CVE-2020-20467

White Shark System (WSS) 1.3.2 is vulnerable to sensitive information disclosure via the default_task_add.php endpoint. A remote attacker could exploit this to create tasks, exposing data. The vulnerability is documented across multiple feeds (CVE-2020-20467 and related entries) with no public de...

CVE-2020-20466

White Shark System WSS 1.3.2 is vulnerable to unauthorized access via usereditpassword.php, remote attackers can modify the password of any user...

CVE-2020-20466

White Shark System (WSS) version 1.3.2 contains an unauthenticated vulnerability in user_edit_password.php allowing remote attackers to modify passwords of arbitrary users. This CVE-2020-20466 entry is corroborated by multiple sources (Red Hat, CNVD, NVD, and other catalogs) and is described as a...