CVE-2019-19857

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. An admin can change their password without providing the current password, by using interfaces outside the Change Password screen. Thus, requiring the admin to enter an Old Password value on the Change...

CVE-2019-19855

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. admin/listuser allows stored XSS via the authtype parameter...

CVE-2019-19858

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. admin/adduser/UID allows stored XSS via the author parameter...

CVE-2019-19856

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. The User Type on the admin/listuser page allows stored XSS via the type parameter...

CVE-2019-19859

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. The Add Collaborator allows unlimited data via the author parameter, even if the data does not match anything in the database...

CVE-2019-19856

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. The User Type on the admin/listuser page allows stored XSS via the type parameter...

CVE-2019-19859

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. The Add Collaborator allows unlimited data via the author parameter, even if the data does not match anything in the database...

CVE-2019-19854

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. It does not use CSRF Tokens to mitigate against CSRF; it uses the Origin header which must match the request origin. This is problematic in conjunction with XSS: one can escalate privileges from User level ...

Design/Logic Flaw

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. admin/listuser allows stored XSS via the authtype parameter...

Cross site scripting

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. The User Type on the admin/listuser page allows stored XSS via the type parameter...

Cross site request forgery (csrf)

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. It does not use CSRF Tokens to mitigate against CSRF; it uses the Origin header which must match the request origin. This is problematic in conjunction with XSS: one can escalate privileges from User level ...

Cross site scripting

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. admin/adduser/UID allows stored XSS via the author parameter...

Code injection

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. The Add Collaborator allows unlimited data via the author parameter, even if the data does not match anything in the database...

Design/Logic Flaw

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. An admin can change their password without providing the current password, by using interfaces outside the Change Password screen. Thus, requiring the admin to enter an Old Password value on the Change...

CVE-2019-19854

CVE-2019-19854 affects Serpico (SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The issue is CSRF protection failure: the app does not use CSRF tokens and relies on the Origin header to validate requests. This weakness is stated to enable privilege escalation from User to Administrator when ...

CVE-2019-19854

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. It does not use CSRF Tokens to mitigate against CSRF; it uses the Origin header which must match the request origin. This is problematic in conjunction with XSS: one can escalate privileges from User level ...

CVE-2019-19855

CVE-2019-19855 affects Serpico (SimplE RePort wrIting and CollaboratiOn tool) v1.3.0. The vulnerability is a stored XSS in admin/list_user exploitable via the auth_type parameter. This is due to improper input handling in that endpoint, enabling script execution in a victim’s browser when the aff...

CVE-2019-19855

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. admin/listuser allows stored XSS via the authtype parameter...

CVE-2019-19856

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. The User Type on the admin/listuser page allows stored XSS via the type parameter...

CVE-2019-19856

CVE-2019-19856 affects Serpico (SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The vulnerability is a stored cross-site scripting (XSS) flaw in the admin/list_user page, exploitable via the type parameter. The issue is supported by multiple connected sources describing Serpico’s admin/User ...