603 matches found
CVE-2021-20737
Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors...
CVE-2021-20736
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors...
CVE-2021-20737
Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors...
CVE-2021-20737
Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors...
CVE-2021-20737
GROWI vulnerability CVE-2021-20737 (improper authentication) affects WESEEK GROWI versions prior to v4.2.20. A remote attacker could view unauthorized pages without access privileges via unspecified vectors. The related Prion/Red Hat/OSV/NVD entries agree the issue is an authentication flaw affec...
CVE-2021-20736
CVE-2021-20736 affects GROWI; NoSQL injection (CWE-943) vulnerability in GROWI versions prior to v4.2.20 could allow a remote attacker to obtain or alter data via unspecified vectors. Connected sources confirm the fixed version is v4.2.20 (and the 4.2.x line), with guidance to upgrade; there is n...
CVE-2021-20736
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors...
CVE-2021-20736
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors...
PT-2021-14192
Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v4.2.20 Description: A NoSQL injection issue allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors. Recommendations: For versions prior to v4.2.20, update to...
PT-2021-14193
Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v4.2.20 Description: The issue allows a remote attacker to view unauthorized pages without access privileges via unspecified vectors. This is due to an improper authentication vulnerability. Recommendations: For versio...
CVE-2021-20737: Improper Authentication
Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors...
CVE-2021-20736: Improper Neutralization of Special Elements in Output Used by a Downstream Component
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors...
WESEEK GROWI Access Control Error Vulnerability (CNVD-2021-43487)
Weseek GROWI is a suite of team collaboration software from Weseek Japan. An access control error vulnerability exists in WESEEK GROWI that originates from an error in the handling of authentication requests. A remote, authenticated attacker could exploit the vulnerability to view unauthorized...
WESEEK GROWI Input Validation Error Vulnerability (CNVD-2021-43488)
Weseek GROWI is a suite of team collaboration software from Weseek Japan. An input validation error vulnerability exists in WESEEK GROWI that arises from a network system or product that does not properly validate input data. A remote attacker could exploit this vulnerability to obtain or tamper...
JVN#95457785: Multiple vulnerabilities in GROWI
GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below. NoSQL injection CWE-943 - CVE-2021-20736 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L| Base Score: 7.3 CVSS v2| AV:N/AC:L/Au:N/C:P/I:P/A:P| Base Score: 7.5 Improper...
Weseek GROWI 授权问题漏洞
Weseek GROWI is a suite of team collaboration software from Weseek Japan. An access control error vulnerability exists in WESEEK GROWI that originates from an error in the handling of authentication requests. A remote, authenticated attacker could exploit the vulnerability to view unauthorized...
Weseek GROWI 注入漏洞
Weseek GROWI is a suite of team collaboration software from Weseek Japan. An input validation error vulnerability exists in WESEEK GROWI that arises from a network system or product that does not properly validate input data. A remote attacker could exploit this vulnerability to obtain or tamper...
GROWI Cross-Site Scripting Vulnerability (CNVD-2021-19695)
Weseek GROWI is a suite of team collaboration software from Weseek Japan. A reflected cross-site scripting vulnerability exists in GROWI 4.2.0 - 4.2.7. The vulnerability stems from insufficient validation of URL query parameters. An attacker can exploit this vulnerability to execute arbitrary...
GROWI Cross-Site Scripting Vulnerability (CNVD-2021-19694)
Weseek GROWI is a suite of team collaboration software from Weseek Japan. A stored cross-site scripting vulnerability exists in the administrator page in GROWI 4.2.0 - 4.2.7. An attacker can exploit this vulnerability to execute arbitrary script in a logged-in user's web browser...
