EUVD-2019-3939

Malware in sbrugna...

EUVD-2019-3948

Malware in sbrugna...

CVE-2019-12271

Sandline Centraleyezer On Premises allows unrestricted File Upload with a dangerous type, because the feature of adding ".jpg" to any uploaded filename is not enforced on the server side...

CVE-2019-12299

Sandline Centraleyezer On Premises allows Stored XSS using HTML entities in the name field of the Category section...

CVE-2019-12311

Sandline Centraleyezer On Premises allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded to the server. When a victim tries to download a CISO Report template, the script is loaded...

Unrestricted file upload

Sandline Centraleyezer On Premises allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded to the server. When a victim tries to download a CISO Report template, the script is loaded...

Design/Logic Flaw

Sandline Centraleyezer On Premises allows Stored XSS using HTML entities in the name field of the Category section...

Unrestricted file upload

Sandline Centraleyezer On Premises allows unrestricted File Upload with a dangerous type, because the feature of adding ".jpg" to any uploaded filename is not enforced on the server side...

CVE-2019-12311

CVE-2019-12311 affects Sandline Centraleyezer (On Premises). The issue is an unrestricted file upload vulnerability in Centraleyezer that allows uploading an HTML page containing a script, which can be loaded when a victim downloads a CISO Report template, leading to stored XSS. Multiple connecte...

CVE-2019-12299

The connected records confirm a Stored XSS vulnerability in Sandline Centraleyezer (On Premises) affecting the Category section’s name field. Root cause: lack of proper validation of client-side data (HTML entities). Impact: client-side code execution. No version-specific affected components or p...

CVE-2019-12271

Sandline Centraleyezer (On Premises) is affected by CVE-2019-12271 due to server-side lack of enforcement for uploaded filename extensions (adding ".jpg" is not enforced). This enables unrestricted file upload, with the potential for dangerous file types to be uploaded and, per CNVD-2020-03045, p...

CVE-2019-12271

Sandline Centraleyezer On Premises allows unrestricted File Upload with a dangerous type, because the feature of adding ".jpg" to any uploaded filename is not enforced on the server side...

CVE-2019-12271: Unrestricted Upload of File with Dangerous Type

Sandline Centraleyezer On Premises allows unrestricted File Upload with a dangerous type, because the feature of adding ".jpg" to any uploaded filename is not enforced on the server side...

CVE-2019-12311: Improper Neutralization of Input During Web Page Generation

Sandline Centraleyezer On Premises allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded to the server. When a victim tries to download a CISO Report template, the script is loaded...

PT-2019-12746

Name of the Vulnerable Software and Affected Versions Sandline Centraleyezer On Premises affected versions not specified Description The issue allows for Unrestricted File Upload, leading to Stored XSS. This means an HTML page running a script could be uploaded to the server. When a victim attemp...

PT-2019-12740

Name of the Vulnerable Software and Affected Versions Sandline Centraleyezer On Premises affected versions not specified Description The issue allows for Stored XSS using HTML entities in the name field of the Category section. Recommendations At the moment, there is no information about a newer...

CVE-2019-12299: Improper Neutralization of Input During Web Page Generation

Sandline Centraleyezer On Premises allows Stored XSS using HTML entities in the name field of the Category section...

PT-2019-12724

Name of the Vulnerable Software and Affected Versions Sandline Centraleyezer On Premises affected versions not specified Description The issue allows for unrestricted file upload with dangerous types. This is because the feature of adding ".jpg" to any uploaded filename is not enforced on the...