Multiple vulnerabilities in GROWI

Overview GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below. Denial-of-service DoS due to improper verification of input values CWE-400 - CVE-2020-5682 Directory traversal due to improper verification of uploaded files CWE-22 - CVE-2020-5683 These vulnerabilities were...

JVN#94169589: Multiple vulnerabilities in GROWI

GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below. Denial-of-service DoS due to improper verification of input values CWE-400 - CVE-2020-5682 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L| Base Score: 5.3 CVSS v2|...

Weseek GROWI 输入验证错误漏洞

GROWI is a team collaboration software. WESEEK GROWI suffers from an input validation error vulnerability that can be exploited by remote attackers to cause a denial of service...

Weseek GROWI 路径遍历漏洞

GROWI is a team collaboration software. A directory traversal vulnerability exists in WESEEK GROWI, which can be exploited by remote attackers to alter data by uploading specially crafted files...

CVE-2020-5677

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5676

GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors...

CVE-2020-5677

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5678

Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5676

GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors...

CVE-2020-5678

Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5676

GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors...

Cross site scripting

Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

Information disclosure

GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors...

CVE-2020-5677

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

Cross site scripting

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5678

Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5678

CVE-2020-5678 is a stored cross-site scripting vulnerability affecting GROWI up to v3.8.1 (and related CVEs cover other processed inputs). The connected sources confirm the issue is a stored XSS vulnerability in GROWI’s handling of POST requests/input processing, allowing remote attackers to inje...

CVE-2020-5678

Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

CVE-2020-5677

CVE-2020-5677 affects GROWI (WESEEK) prior to v4.1.5, with a reflected cross-site scripting vulnerability in versions

CVE-2020-5677

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...