CVE-2021-20875

CVE-2021-20875 is an open redirect vulnerability in GroupSession products (Free edition v5.1.1 and earlier, byCloud v5.1.1 and earlier, ZION v5.1.1 and earlier). The root cause is input validation that allows a specially crafted URL to redirect users to arbitrary sites, enabling phishing when use...

CVE-2021-20874: Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain...

PT-2021-14314

Name of the Vulnerable Software and Affected Versions: GroupSession Free edition versions 5.1.1 and earlier GroupSession byCloud versions 5.1.1 and earlier GroupSession ZION versions 5.1.1 and earlier Description: A path traversal vulnerability allows an attacker with administrative privilege to...

PT-2021-14313

Name of the Vulnerable Software and Affected Versions: GroupSession Free edition versions 5.1.1 and earlier GroupSession byCloud versions 5.1.1 and earlier GroupSession ZION versions 5.1.1 and earlier Description: The issue allows a remote unauthenticated attacker to redirect users to arbitrary w...

CVE-2021-20876: Improper Limitation of a Pathname to a Restricted Directory

Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows an attacker with an administrative privilege to obtain sensitive information stored in the hierarchy above the directory on...

CVE-2021-20788

Server-side request forgery SSRF vulnerability in GroupSession GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0 allows a remote...

CVE-2021-20786

Cross-site request forgery CSRF vulnerability in GroupSession GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0 allows a remote attacke...

CVE-2021-20789

Open redirect vulnerability in GroupSession GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0 allows a remote attacker to redirect a us...

CVE-2021-20785

Cross-site scripting vulnerability in GroupSession GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0 allows a remote attacker to inject...

CVE-2021-20787

Cross-site scripting vulnerability in GroupSession GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0 allows a remote attacker to inject...

CVE-2021-20785

CVE-2021-20785 is a Cross-site Scripting vulnerability in GroupSession (Japan Total System GroupSession) affecting Free edition (ver2.2.0–pre-5.1.0), GroupSession byCloud (ver3.0.3–pre-5.1.0), and GroupSession ZION (ver3.0.3–pre-5.1.0). The root cause is input handling that allows a remote attack...

PT-2021-14244

Name of the Vulnerable Software and Affected Versions: GroupSession Free edition versions 2.2.0 through 5.1.0 GroupSession byCloud versions 3.0.3 through 5.1.0 GroupSession ZION versions 3.0.3 through 5.1.0 Description: The issue allows a remote attacker to redirect a user to an arbitrary web sit...

PT-2021-14240

Name of the Vulnerable Software and Affected Versions: GroupSession Free edition versions 2.2.0 through 5.1.0 GroupSession byCloud versions 3.0.3 through 5.1.0 GroupSession ZION versions 3.0.3 through 5.1.0 Description: A cross-site scripting issue allows a remote attacker to inject an arbitrary...

JVN#86026700: Multiple vulnerabilities in GroupSession

GroupSession provided by Japan Total System Co.,Ltd. contains multiple vulnerabilities listed below. Cross-site scripting vulnerability CWE-79 - CVE-2021-20785 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2|...