62 matches found
CVE-2020-20070
CVE-2020-20070 is a Cross-Site Scripting vulnerability in wkeyuan DWSurvey 1.0 that allows remote attackers to execute arbitrary code via the qultemld parameter in the qu-multi-fillblank!answers.action endpoint. NVD/CM sources assign CVSS v3.1 base score 6.1 (MEDIUM) with NETWORK attack vector, L...
CVE-2021-39384
DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java...
CVE-2021-39383
DWSurvey v3.2.0 was discovered to contain a remote command execution RCE vulnerability via the component /sysuser/SysPropertyAction.java...
CVE-2021-39383
DWSurvey v3.2.0 was discovered to contain a remote command execution RCE vulnerability via the component /sysuser/SysPropertyAction.java...
CVE-2021-39384
DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java...
Arbitrary file deletion
DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java...
Command injection
DWSurvey v3.2.0 was discovered to contain a remote command execution RCE vulnerability via the component /sysuser/SysPropertyAction.java...
CVE-2021-39384
CVE-2021-39384 : DWSurvey v3.2.0 contains an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java. This is the root cause described in the CVE entry. CVSS metrics indicate a high-severity issue (CVSSv3.1 base score 9.8, CRITICAL) with NETWORK attack vector, no authentica...
CVE-2021-39384
DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java...
CVE-2021-39383
DWSurvey v3.2.0 was discovered to contain a remote command execution RCE vulnerability via the component /sysuser/SysPropertyAction.java...
CVE-2021-39383
CVE-2021-39383 affects DWSurvey 3.2.0, with a remote code execution vulnerability exposed through the component /sysuser/SysPropertyAction.java. The connected documents confirm the flaw and its impact as RCE, but do not provide any patch version or mitigation details. No exploitation status is do...
DWSurvey 代码注入漏洞
DWSurvey is a questionnaire system written in Java. DWSurvey v3.2.0 suffers from a code injection vulnerability that could allow an attacker to perform Remote Command Execution RCE via the component /sysuser/SysPropertyAction.java...
CVE-2019-15095
DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter...
CVE-2019-15095
DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter...
Cross site scripting
DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter...
CVE-2019-15095
DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter...
CVE-2019-15095
DWSurvey (Java-based questionnaire system) is affected by CVE-2019-15095 through 2019-07-22, exposing a reflected XSS due to improper validation of client-side data in the surveyId parameter of design/qu-multi-fillblank!answers.action. The vulnerability enables execution of arbitrary client-side ...
DWSurvey Cross-Site Scripting Vulnerability
DWSurvey is a questionnaire system written in Java. A cross-site scripting vulnerability exists in DWSurvey 2019-07-22 and earlier versions, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute client-side code...