CVE-2019-10263

CVE-2019-10263 affects Ahsay Cloud Backup Suite prior to 8.1.1.50. The initial description documents an XSS vulnerability in the Alias field during trial account creation that could lead to an admin cookie theft and account takeover. Multiple connected sources corroborate the Ahsay exposure and s...

CVE-2019-10264

The affected product is Ahsay Cloud Backup Suite prior to 8.1.1.50. With a valid administrator account, the Move / Import / Export Users screen’s Import Users option accepts a ZIP archive containing a users.xml file, which can trigger an XML External Entity (XXE) vulnerability. This impacts multi...

CVE-2019-10265

CVE-2019-10265 affects Ahsay Cloud Backup Suite prior to 8.1.1.50. The vulnerability exists on the /cbs/system/ShowAdvanced.do “File Explorer” screen, where input in the JavaScript code can change the directory to an arbitrary path (e.g., C:), enabling an attacker to browse the server filesystem....