CVE-2020-25399

CVE-2020-25399 InterMind iMind Server 3.13.65 이하 버전에 저장형 XSS 취약점이 존재하여, 모든 사용자가 채팅에서 악성 파일을 전송하여 다른 사용자의 세션을 탈취할 수 있습니다. 정보 설명: 공격자는 채팅 기능을 사용하여 모든 사용자에게 악성 파일을 전송할 수 있습니다. 파일에는 JS 페이로드가 포함될 수 있으며, 파일이 열린 후 피해자의 브라우저에서 실행됩니다. 연구자: Andrey Skuratov https://github.com/h3llraiser/ 발행일: 2020-07-06 초기 ...

CVE-2020-25398

CVE-2020-25398 CSV 인젝션이 csv 내보내기 기능을 통해 InterMind iMind Server 3.13.65 이하에 존재합니다. 정보 설명: 공격자는 특정 데이터를 구성할 수 있으며, 이는 코드 실행 페이로드가 포함된 악성 csv 파일로 내보내져 사용자 시스템에서 열릴 때 실행됩니다. 연구자: Andrey Skuratov https://github.com/h3llraiser/ 발견일: 2020-07-06 초기 권고 공개 릴리스: VEL 링크: 곧 제공 예정 NIST CVE 링크: 곧 제공 예정 스크린샷:...

EUVD-2020-18086

Malware in sbrugna...

EUVD-2020-18085

Malware in sbrugna...

CVE-2020-25399

Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat...

CVE-2020-25398

CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality...

CVE-2020-25398

CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality...

CVE-2020-25398

CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality...

CVE-2020-25399

Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat...

Cross site scripting

Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat...

CVE-2020-25398

CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality...

CVE-2020-25398

CVE-2020-25398 affects InterMind iMind Server up to version 3.13.65, via the csv export function. The root cause is CSV Injection in exported CSV data. CVSS-3.1 vector indicates Network attack, high impact to confidentiality, integrity, and availability (base 8.8). Practical exploitation details ...

CVE-2020-25399

CVE-2020-25399 affects InterMind iMind Server up to version 3.13.65. The issue is a Stored XSS in the chat file handling that allows any user to hijack another user’s session. Documents do not specify the exact vulnerable component or root cause details beyond the stored XSS in chat. Impact is de...

CVE-2020-25399

Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat...

CVE-2020-25399: Improper Neutralization of Input During Web Page Generation

Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat...

CVE-2020-25398: Improper Neutralization of Formula Elements in a CSV File

CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality...

CVE-2020-24765

InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request...

Server side request forgery (ssrf)

InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request...

CVE-2020-24765

InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request...

CVE-2020-24765

InterMind iMind Server up to version 3.13.65 is affected by an unauthenticated remote read of the self‑diagnostic archive via the endpoint /api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1. The issue allows remote attackers to access diagnostic archives, and reports describe ...