CVE-2020-35726

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Reports/index.jsp file via the by parameter. NOTE: This vulnerability only affects products that are no longer supported by t...

CVE-2020-35726

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Reports/index.jsp file via the by parameter. NOTE: This vulnerability only affects products that are no longer supported by t...

CVE-2020-35726

CVE-2020-35726 effects Quest Policy Authority version 8.1.2.200, with a reflected XSS vulnerability exploitable via a crafted link to /WebCM/Applications/Reports/index.jsp using the by parameter. Public references consistently describe the issue and note affected products are no longer supported....

CVE-2020-35725

Affected software: Quest Policy Authority 8.1.2.200. Issue: Reflected XSS enabling remote attackers to inject arbitrary script via a crafted link to /WebCM/index.jsp using the msg parameter. Root cause: user-supplied msg value reflected in the page, enabling code execution in the browser. Impact:...

CVE-2020-35725

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2020-35725

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2020-35724

Quest Policy Authority 8.1.2.200 is affected by a reflected XSS vulnerability. Exploitation vectors: crafted links to Error.jsp via the err parameter, or indirectly via cpr, tcp, or abs parameters. Impact: user’s browser code execution; affected products are no longer maintained, with no fixed ve...

CVE-2020-35723

CVE-2020-35723 : Reflected XSS in Quest Policy Authority (version 8.1.2.200) allows remote attackers to inject code via a crafted link to ReportPreview.do using the referer parameter. The vulnerability affects products no longer supported by the maintainer. Connected sources report no official fi...

CVE-2020-35722

CSRF in Web Compliance Manager in Quest Policy Authority 8.1.2.200 allows remote attackers to force user modification/creation via a specially crafted link to the submitUser.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2020-35722

The data shows a concrete CSRF vulnerability in Quest Policy Authority 8.1.2.200, affecting the Web Compliance Manager component (submitUser.jsp) and enabling remote modification/creation of user accounts. Root cause: CSRF in Web Compliance Manager. Impact: allows unauthorized user modifications ...

CVE-2020-35722

CSRF in Web Compliance Manager in Quest Policy Authority 8.1.2.200 allows remote attackers to force user modification/creation via a specially crafted link to the submitUser.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2020-35721

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseAssets.do file via the title parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2020-35721

Quest Policy Authority 8.1.2.200 is affected by a reflected XSS via the BrowseAssets.do title parameter. Root cause: user-controlled title reflected to browser; impact: remote code injection in victims’ browsers. Exploitation details are not provided in the documents. The PT-2021-11833 advisory l...

CVE-2020-35720

Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields first name, last name, and logon name when creating or modifying a user via the submitUser.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the...

CVE-2020-35720

CVE-2020-35720 affects Quest Policy Authority 8.1.2.200. A stored XSS vulnerability exists in multiple user-creation/modification fields (first name, last name, logon name) via submitUser.jsp. Exploitation details are not provided beyond this description. The vulnerability impacts products no lon...

CVE-2020-35719

CVE-2020-35719 is a reflected XSS in Quest Policy Authority 8.1.2.200. The vulnerability occurs when a crafted link to the URL path /WebCM/Applications/Search/index.jsp with an added parameter allows injection of malicious code into the browser. The affected product/version is no longer supported...

CVE-2020-35719

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Search/index.jsp file via the added parameter. NOTE: This vulnerability only affects products that are no longer supported by...

CVE-2020-35204

CVE-2020-35204 is a reflected XSS affecting Quest Policy Authority 8.1.2.200. The vulnerability allows injecting code via the unqID parameter in PolicyAuthority/Common/FolderControl.jsp. The affected product is no longer supported. Public sources do not list a fixed version; a PT-2021-11722 advis...

CVE-2020-35204

Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the PolicyAuthority/Common/FolderControl.jsp file via the unqID parameter. NOTE: This vulnerability only affects products that are no longer support...

CVE-2020-35204

Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the PolicyAuthority/Common/FolderControl.jsp file via the unqID parameter. NOTE: This vulnerability only affects products that are no longer support...