CVE-2019-19857

Affected product: Serpico 1.3.0 (SimplE RePort wrIting and CollaboratiOn tool). Vulnerability: Admin can change their password without providing the current password via interfaces outside the Change Password screen. This bypasses the Old Password check and is noted to be problematic in conjuncti...

CVE-2019-19857

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. An admin can change their password without providing the current password, by using interfaces outside the Change Password screen. Thus, requiring the admin to enter an Old Password value on the Change...

CVE-2019-19858

Serpico (SimplE RePort wrIting and CollaboratiOn tool) 1.3.0 contains a stored XSS vulnerability in the admin/add_user/UID path via the author parameter. The issue is documented across multiple sources (NVD, OSV, CVE records) with the root cause described as lack of proper validation on client-si...

CVE-2019-19858

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. admin/adduser/UID allows stored XSS via the author parameter...

CVE-2019-19859

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. The Add Collaborator allows unlimited data via the author parameter, even if the data does not match anything in the database...

CVE-2019-19859

The CVE-2019-19859 entry concerns Serpico (SimplE RePort wrIting and CollaboratiOn tool) version 1.3.0. The vulnerability is described as an input validation error in the Add Collaborator feature, where the author parameter allows unlimited data to be submitted even if it does not match existing ...

Serpico Cross-Site Scripting Vulnerability (CNVD-2020-03851)

Serpico is a penetration test report generation and collaboration tool. A cross-site scripting vulnerability exists in admin/adduser/UID in Serpico version 1.3.0, which stems from the lack of proper validation of client-side data in a WEB application and can be exploited by an attacker to execute...

Serpico Input Validation Error Vulnerability

Serpico is a penetration test report generation and collaboration tool. An input validation error vulnerability exists in Serpico version 1.3.0, which arises from a networked system or product that does not properly validate incoming data and can be exploited by an attacker to add an unlimited...

Serpico admin user can be accessed without admin creds

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. An admin can change their password without providing the current password, by using interfaces outside the Change Password screen. Thus, requiring the admin to enter an Old Password value on the Change...

Serpico Cross-Site Scripting Vulnerability (CNVD-2020-03856)

Serpico is a penetration test report generation and collaboration tool. A cross-site scripting vulnerability exists in Serpico version 1.3.0 in admin/listuser, which stems from the lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute...

Blackhat 2015 Arsenal

Last month at Blackhat Arsenal 2015, Pete and I @willis presented on Serpico. This was our second time at Arsenal. Yet again, awesome people, great venue, and overall a highlight for me of BH/DC/LV. We got some excellent feedback on the project, so thank you to anyone who stopped by. Last year I...

Blackhat 2014 Arsenal Experience

Last week at Blackhat Arsenal 2014, Pete and I @willis presented on Serpico. Arsenal was a great experience and I would highly recommend to anyone as an attendee or presenter. We got some great feedback on the project, so thank you to anyone who stopped by. Here were the top 3 feature requests an...