CVE-2023-34837

Microworld Technologies eScan Management Console ver. 14.0.1400.2281 is affected by a Cross-Site Scripting vulnerability where the GrpPath parameter is vulnerable. Root cause: insufficient input validation in GrpPath enables remote code execution in affected web UI. Impact, per CVSS 3.1 vector, i...

CVE-2023-34836

The CVE-2023-34836 entry concerns Microworld Technologies’ eScan Management Console, version 14.0.1400.2281. The vulnerability is a Cross Site Scripting (XSS) flaw that enables a remote attacker to execute arbitrary code by crafting scripts passed via the Dtltyp and ListName parameters. This is r...

CVE-2024-42919

CVE-2024-42919 affects MicroWorld eScan Management Console 14.0.1400.2281, with a vulnerability described as Incorrect Access Control via the acteScanAVReport function. The CVSS 3.1 score is 9.8 (CRITICAL) with network attack vector, no user interaction, and total impact to confidentiality, integ...

CVE-2023-31702

The CVE-2023-31702 vulnerability affects MicroWorld eScan Management Console 14.0.1400.2281. It is a SQL injection in the GetUserCurrentPwd?UsrId=1 endpoint used in the View User Profile, enabling an authenticated attacker to dump the entire database and potentially execute OS commands on the bac...

CVE-2023-34838

CVE-2023-34838 affects Microworld Technologies eScan Management Console (v14.0.1400.2281). It is a Cross-Site Scripting vulnerability in the Description parameter that allows a remote attacker to execute arbitrary code via a crafted script. Root cause appears to be insufficient input sanitization...

CVE-2023-33730

The CVE-2023-33730 vulnerability affects Microworld Technologies eScan Management Console version 14.0.1400.2281, in the GetUserCurrentPwd function, allowing remote attackers to retrieve plaintext passwords for admins or users. The underlying issue enables privilege escalation and full account co...

CVE-2023-33731

Microworld Technologies eScan management console (version 14.0.1400.2281) is affected by a Reflected Cross Site Scripting (XSS) vulnerability in the view dashboard detail feature. The flaw allows an attacker to inject arbitrary script via a URL parameter (DashBoardDetails), with evidence of explo...

CVE-2023-33732

CVE-2023-33733 concerns the Python ReportLab library. A sandbox bypass in ReportLab could allow arbitrary code execution when processing crafted PDFs. Public advisories (e.g., Debian DSA-5791/DLA-3917) state that vulnerable versions up to 3.6.12-1+deb12u1 (and earlier 3.5.59-2+deb11u1 in Debian 1...

CVE-2023-31703

CVE-2023-31703 affects Microworld eScan Management Console (v14.0.1400.2281). A Cross-Site Scripting flaw in the editUserName form via the from parameter enables remote injection of arbitrary code. Documented risk includes potential session-cookie theft leading to account takeover (as shown in Po...

CVE-2023-34835

The vulnerability CVE-2023-34835 affects Microworld Technologies eScan Management Console 14.0.1400.2281. A Cross Site Scripting flaw exists in the delete_file parameter, enabling a remote attacker to inject and execute arbitrary JavaScript. The issue is documented in PT-2023-25021 with the affec...