CVE-2020-35205

Server Side Request Forgery SSRF in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal ports and make outbound connections via the initFile.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2020-35205

Summary: CVE-2020-35205 is an SSRF vulnerability in Quest Policy Authority’s Web Compliance Manager (version 8.1.2.200). The issue allows an attacker to trigger requests via the initFile.jsp file to scan internal ports and make outbound connections. The affected product is no longer supported by ...

CVE-2020-35206

CVE-2020-35206 is a Reflected XSS in Quest Policy Authority (Web Compliance Manager) version 8.1.2.200, triggered by a crafted link to cConn.jsp via the ur parameter. Multiple connected sources (Red Hat, NVD, CVE lists, PT-Security) confirm the affected product and vector; public details are limi...

CVE-2020-35206

Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the cConn.jsp file via the ur parameter. NOTE: This vulnerability only affects products that are no longer supported by th...

CVE-2020-35203

Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the initFile.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported b...

CVE-2020-35203

Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the initFile.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported b...

CVE-2020-35203

Consolidated details from connected sources confirm CVE-2020-35203 describes a Reflected XSS in Quest Policy Authority’s Web Compliance Manager (version 8.1.2.200). The vulnerability arises when an attacker crafts a link targeting initFile.jsp with a malicious msg parameter, enabling script injec...

PT-2021-11832 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows remote attackers to store malicious code in multiple fields, such as first name, last name, and logon name, when creating or modifying a user via the "submitUser.jsp" file...

PT-2021-11838 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows remote attackers to inject malicious code into the browser via a specially crafted link to the "/WebCM/Applications/Reports/index.jsp" file via the by parameter. This...

PT-2021-11723 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows attackers to perform Server Side Request Forgery SSRF in the Web Compliance Manager component, enabling them to scan internal ports and make outbound connections via the...

PT-2021-11724 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows attackers to inject malicious code into the browser via a specially crafted link to the "cConn.jsp" file using the ur parameter. This affects products that are no longer...

PT-2021-11833 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows remote attackers to inject malicious code into the browser via a specially crafted link to the "BrowseAssets.do" file using the title parameter. This affects products that...

PT-2021-11836 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows remote attackers to inject malicious code into the browser via a specially crafted link to the "Error.jsp" file. This can be achieved directly via the err parameter or...

PT-2021-11834 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows remote attackers to force user modification or creation via a specially crafted link to the submitUser.jsp file. This is a result of a CSRF vulnerability in the Web...

PT-2021-11839 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows remote attackers to inject malicious code into the browser via a specially crafted link to the "BrowseDirs.do" file using the title parameter. This affects products that a...

PT-2021-11831 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows remote attackers to inject malicious code into the browser via a specially crafted link to the "/WebCM/Applications/Search/index.jsp" file via the added parameter. This...

PT-2021-11837 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows remote attackers to inject malicious code into the browser via a specially crafted link to the "/WebCM/index.jsp" file using the msg parameter. This affects products that...

PT-2021-11722 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows attackers to inject malicious code into the browser via a specially crafted link to the "PolicyAuthority/Common/FolderControl.jsp" file using the unqID parameter. This...

PT-2021-11835 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows remote attackers to inject malicious code into the browser via a specially crafted link to the "ReportPreview.do" file using the referer parameter. This affects products...

Quest Policy Authority Cross-Site Scripting Vulnerability

Quest Software Policy Authority For Unified Communications is a software from Quest Software, Inc. that is used in enterprise environments to consolidate communication data text and instant messaging, videoconferencing, email and voicemail between various media. A cross-site scripting vulnerabili...