CVE-2019-16664

ThinkSAAS 2.91 is affected by CVE-2019-16664: an XSS via the parameter groupname in index.php?app=group&ac=create&ts=do. Root cause described across sources is insufficient sanitization of the groupname input, enabling cross-site scripting. Affected product/version: ThinkSAAS 2.91. The Red Hat ad...

PT-2019-14751

Name of the Vulnerable Software and Affected Versions ThinkSAAS version 2.91 Description An issue was discovered where there is a potential for XSS via the content to the "index.php?app=group&ac=comment&ts=do&js=1" URI. This can be demonstrated by a crafted SVG document in the SRC attribute of an...

PT-2019-14750

Name of the Vulnerable Software and Affected Versions ThinkSAAS version 2.91 Description An issue was discovered that allows for XSS via the index.php?app=group&ac=create&ts=do endpoint, specifically through the groupname parameter. Recommendations For ThinkSAAS version 2.91, consider restricting...

CVE-2018-15130

CVE-2018-15130 affects ThinkSAAS up to 2018-07-25. The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the parameter groupdesc in the URL path index.php?app=group&ac=create&ts=do, allowing injection of arbitrary web script/HTML into the page. Root cause details beyond XSS are n...

CVE-2018-15129: Improper Neutralization of Input During Web Page Generation

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...

PT-2018-12886

Name of the Vulnerable Software and Affected Versions ThinkSAAS versions prior to 2018-07-25 Description The issue allows for XSS via the content parameter in the "index.php?app=article&ac=comment&ts=do" endpoint. Recommendations For versions prior to 2018-07-25, update to a version released afte...

PT-2018-12888

Name of the Vulnerable Software and Affected Versions ThinkSAAS versions prior to 2018-07-25 Description The issue allows for XSS via the index.php?app=group&ac=create&ts=do endpoint, specifically through the groupdesc parameter. Recommendations For versions prior to 2018-07-25, avoid using the...