CVE-2020-28031

CVE-2020-28031 affects eramba up to version 2.8.1, where HTTP Host header injection is possible. The impact described is that authenticated users can leverage wkhtml2pdf to print PDFs due to this header manipulation. The provided connected sources confirm the vulnerability description but do not ...

CVE-2020-28031

eramba through c2.8.1 allows HTTP Host header injection with for example resultant wkhtml2pdf PDF printing by authenticated users...

CVE-2020-25105

eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token createHash has only a million possibilities...

CVE-2020-25104

eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example, the filename has a complete XSS payload followed by the .png extension...

CVE-2020-25105

eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token createHash has only a million possibilities...

CVE-2020-25104

eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example, the filename has a complete XSS payload followed by the .png extension...

Cross site scripting

eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example, the filename has a complete XSS payload followed by the .png extension...

Code injection

eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token createHash has only a million possibilities...

CVE-2020-25104

eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example, the filename has a complete XSS payload followed by the .png extension...

CVE-2020-25104

CVE-2020-25104 affects eramba:2.8.1 and Enterprise before e2.19.3. A crafted filename attached to an object can trigger XSS (e.g., a complete XSS payload followed by the .png extension). The connected documents consistently describe a stored/attached file name-based XSS vector. No explicit exploi...

CVE-2020-25105

eramba c2.8.1 and Enterprise before e2.19.3 expose a weak password recovery token: createHash has only ~1,000,000 possibilities, enabling guessable token recovery. CVSS vectors show MEDIUM (2.0) and CRITICAL (3.1) with HIGH impact to confidentiality, integrity, and availability; no remediation de...

CVE-2020-25105

eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token createHash has only a million possibilities...

Eramba Cross-Site Scripting Vulnerability

Eramba is an open source, enterprise-level IT governance application from Eramba UK. The program features IT security, compliance auditing and analysis, and more. A cross-site scripting vulnerability exists in the prompt pop-up box in Eramba e version 1.0.6.033, which stems from the program's...

Eramba Cross-Site Scripting Vulnerability (CNVD-2018-06086)

Eramba is an open source, enterprise-level IT governance application from Eramba UK. The program features IT security, compliance auditing and analysis, and more. A cross-site scripting vulnerability exists in the error page of the CSV file inclusion tab of /importTool/preview URI in Eramba e...

Eramba 'advanced_filter' parameter cross-site scripting vulnerability

Eramba is an open source, enterprise-level IT governance application from Eramba UK. The program features IT security, compliance auditing and analysis, and more. A cross-site scripting vulnerability exists in reviews/filterIndex/ThirdPartyRiskReview in Eramba e version 1.0.6.033, which stems fro...

Cross site scripting

Eramba e1.0.6.033 has Stored XSS on the tooltip box via the /programScopes description parameter...

CVE-2018-7997

Eramba e1.0.6.033 has Reflected XSS on the Error page of the CSV file inclusion tab of the /importTool/preview URI, with a CSV file polluted with malicious JavaScript...

Cross site scripting

Eramba e1.0.6.033 has Reflected XSS on the Error page of the CSV file inclusion tab of the /importTool/preview URI, with a CSV file polluted with malicious JavaScript...

CVE-2018-7996

Eramba e1.0.6.033 has Stored XSS on the tooltip box via the /programScopes description parameter...

CVE-2018-7996

Eramba e1.0.6.033 has Stored XSS on the tooltip box via the /programScopes description parameter...