CVE-2017-10711: Improper Neutralization of Input During Web Page Generation

In SimpleRisk 20170614-001, a CSRF attack on reset.php aka the Send Password Reset Email form can insert XSS sequences via the user parameter...

PT-2017-11445

Name of the Vulnerable Software and Affected Versions SimpleRisk version 20170614-001 Description A CSRF attack on the 'reset.php' endpoint, specifically the Send Password Reset Email form, can insert XSS sequences via the user parameter. Recommendations For version 20170614-001, consider disabli...

SimpleRisk 20170416-001 Cross Site Scripting

history.pushState'', '', '/' alert1" input type="submit" value="XSS 1"...

SimpleRisk v20170416-001 Reflected XSS Vulnerabilities

Summary SimpleRisk is an open-source risk management system released under Mozilla Public License and used for risk management activities. It enables risk managers to account for risks, plan mitigation measures, facilitate management reviews, prioritize for project planning, and track periodic...

SimpleRisk 20130915-01 - Multiple Vulnerabilities

No description provided by source. 1. Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting XSS CWE-79, OWASP-...

CVE-2013-5749

Cross-site scripting XSS vulnerability in management/prioritizeplanning.php in SimpleRisk before 20130916-001 allows remote attackers to inject arbitrary web script or HTML via the newproject parameter...

CVE-2013-5748

Cross-site request forgery CSRF vulnerability in management/prioritizeplanning.php in SimpleRisk before 20130916-001 allows remote attackers to hijack the authentication of users for requests that add projects via an addproject action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in management/prioritizeplanning.php in SimpleRisk before 20130916-001 allows remote attackers to hijack the authentication of users for requests that add projects via an addproject action...

Cross site scripting

Cross-site scripting XSS vulnerability in management/prioritizeplanning.php in SimpleRisk before 20130916-001 allows remote attackers to inject arbitrary web script or HTML via the newproject parameter...

CVE-2013-5748

CVE-2013-5748 refers to a CSRF vulnerability in SimpleRisk’s management/prioritize_planning.php prior to version 20130916-001, which allows remote attackers to hijack user sessions for actions such as adding projects via add_project. The underlying issue is a Cross-Site Request Forgery that enabl...

CVE-2013-5749

CVE-2013-5749 describes a cross-site scripting (XSS) vulnerability in SimpleRisk, specifically in management/prioritize_planning.php, exploitable via the new_project parameter. It affects SimpleRisk versions before 20130916-001, enabling remote attackers to inject arbitrary web script/HTML. The c...

CVE-2013-5748

Cross-site request forgery CSRF vulnerability in management/prioritizeplanning.php in SimpleRisk before 20130916-001 allows remote attackers to hijack the authentication of users for requests that add projects via an addproject action...

CVE-2013-5749

Cross-site scripting XSS vulnerability in management/prioritizeplanning.php in SimpleRisk before 20130916-001 allows remote attackers to inject arbitrary web script or HTML via the newproject parameter...

PT-2014-2949

Name of the Vulnerable Software and Affected Versions SimpleRisk versions prior to 20130916-001 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the new project parameter in the management/prioritize planning.php file. Recommendations...

PT-2014-2948

Name of the Vulnerable Software and Affected Versions SimpleRisk versions prior to 20130916-001 Description A cross-site request forgery issue exists, allowing remote attackers to hijack user authentication for requests that add projects via an add project action in the management/prioritize...

CVE-2013-5748: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in management/prioritizeplanning.php in SimpleRisk before 20130916-001 allows remote attackers to hijack the authentication of users for requests that add projects via an addproject action...

CVE-2013-5749: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in management/prioritizeplanning.php in SimpleRisk before 20130916-001 allows remote attackers to inject arbitrary web script or HTML via the newproject parameter...

SimpleRisk 20130915-01 - Multiple Vulnerabilities

Exploit for php platform in category web applications 1. Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting...

SimpleRisk 20130915-01 - Multiple Vulnerabilities

SimpleRisk 20130915-01 - Multiple Vulnerabilities 1. Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting XSS...

SimpleRisk 20130915-01 Cross Site Request Forgery / Cross Site Scripting

Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting XSS CWE-79, OWASP-A3 Impact: Full Account Compromise...