EUVD-2017-7939

Malware in sbrugna...

EUVD-2017-7938

Malware in sbrugna...

Cross site request forgery (csrf)

An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account...

Cross site scripting

An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked...

CVE-2017-16755

An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked...

CVE-2017-16756

An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account...

CVE-2017-16756

CVE-2017-16756 affects Userscape HelpSpot before 4.7.2. A CSRF weakness on POST requests to index.php?pg=password.change allows an attacker to change another user’s password. Impact: credential change without authorization. Remediation: upgrade to HelpSpot 4.7.2 or later (per cited disclosures). ...

CVE-2017-16755

Affected software : Userscape HelpSpot

CVE-2017-16755

An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked...

CVE-2017-16755: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked...

CVE-2017-16756: Cross-Site Request Forgery (CSRF)

An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account...

PT-2018-6330

Name of the Vulnerable Software and Affected Versions: Userscape HelpSpot versions prior to 4.7.2 Description: A cross-site request forgery issue exists, allowing an attacker to change the password of another user's account through POST requests to the "index.php?pg=password.change" endpoint...

PT-2018-6329

Name of the Vulnerable Software and Affected Versions: Userscape HelpSpot versions prior to 4.7.2 Description: A reflected cross-site scripting issue exists in the "return" parameter of the "index.php?pg=moderated" API endpoint. It executes when the return link is clicked. Recommendations: For...