EUVD-2020-7078

Malware in sbrugna...

EUVD-2020-7081

Malware in sbrugna...

BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation Vulnerability

Exploit for multiple platform in category web applications Exploit Title: BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation Exploit Author: William Summerhill Vendor homepage: https://www.globalradar.com/ Version: BSA Radar - Version 1.6.7234.24750 and lower CVE-2020-14945 - Privilege...

BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting Vulnerability

Exploit for multiple platform in category web applications Exploit title: BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting Exploit Author: William Summerhill Vendor homepage: https://www.globalradar.com/ Tested on: Window CVE-2020-14943 Description: The "Firstname" and "Lastname"...

CVE-2020-14946

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transaction files. When downloading the files, a user is able to view local files on the web server by manipulating the FileName and FilePath...

CVE-2020-14945

A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an authenticated, low-privileged user to escalate their privileges to administrator rights i.e., the BankAdmin role via modified SaveUser data...

Code injection

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transaction files. When downloading the files, a user is able to view local files on the web server by manipulating the FileName and FilePath...

CVE-2020-14945

A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an authenticated, low-privileged user to escalate their privileges to administrator rights i.e., the BankAdmin role via modified SaveUser data...

CVE-2020-14946: Improper Limitation of a Pathname to a Restricted Directory

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transaction files. When downloading the files, a user is able to view local files on the web server by manipulating the FileName and FilePath...

CVE-2020-14944: Missing Authorization

Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser...

CVE-2020-14945: Undefined Security Weakness

A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an authenticated, low-privileged user to escalate their privileges to administrator rights i.e., the BankAdmin role via modified SaveUser data...

CVE-2020-14943: Improper Neutralization of Input During Web Page Generation

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting XSS via Update User Profile...