Global RADAR BSA Radar Cross-Site Scripting Vulnerability

Global RADAR BSA Radar is a suite of anti-money laundering AML solutions for the financial sector from US-based Global RADAR. A cross-site scripting vulnerability exists in the 'Firstname' and 'Lastname' parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier versions. The vulnerability...

Global RADAR BSA Radar Unnamed Vulnerability

Global RADAR BSA Radar is a suite of anti-money laundering AML solutions for the financial sector from US-based Global RADAR. A security vulnerability exists in Global RADAR BSA Radar version 1.6.7234.24750 and prior versions that stems from the program's lack of effective authorization controls...

CVE-2020-14946

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transaction files. When downloading the files, a user is able to view local files on the web server by manipulating the FileName and FilePath...

CVE-2020-14946

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transaction files. When downloading the files, a user is able to view local files on the web server by manipulating the FileName and FilePath...

CVE-2020-14945

A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an authenticated, low-privileged user to escalate their privileges to administrator rights i.e., the BankAdmin role via modified SaveUser data...

CVE-2020-14943

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting XSS via Update User Profile...

CVE-2020-14945

A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an authenticated, low-privileged user to escalate their privileges to administrator rights i.e., the BankAdmin role via modified SaveUser data...

CVE-2020-14943

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting XSS via Update User Profile...

CVE-2020-14944

Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser...

Cross site scripting

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting XSS via Update User Profile...

Code injection

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transaction files. When downloading the files, a user is able to view local files on the web server by manipulating the FileName and FilePath...

Privilege escalation

A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an authenticated, low-privileged user to escalate their privileges to administrator rights i.e., the BankAdmin role via modified SaveUser data...

Authorization

Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser...

CVE-2020-14943

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting XSS via Update User Profile...

CVE-2020-14943

CVE-2020-14943 affects Global RADAR BSA Radar versions 1.6.7234.24750 and earlier. The vulnerability is a stored cross-site scripting (XSS) in the Update User Profile feature, exploitable via the Firstname and Lastname parameters. Public PoCs and exploits show injection of script payloads (e.g., ...

CVE-2020-14944

Global RADAR BSA Radar 1.6.7234.24750 and earlier exposes ChangePassword, SaveUserProfile, and GetUser without proper authorization, enabling manipulation and potential takeover of user accounts. Exploitation details in connected sources show a Cross-Site Request Forgery/authorization bypass enab...

CVE-2020-14944

Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser...

CVE-2020-14945

A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an authenticated, low-privileged user to escalate their privileges to administrator rights i.e., the BankAdmin role via modified SaveUser data...

CVE-2020-14945

Global RADAR BSA Radar (versions up to 1.6.7234.24750) contains an authenticated privilege-escalation flaw that lets a low-privileged user gain administrator rights (BankAdmin) by forging/modifying SaveUser data via the SaveUser API. The vulnerability stems from handling of user profile data retr...

CVE-2020-14946

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transaction files. When downloading the files, a user is able to view local files on the web server by manipulating the FileName and FilePath...