CVE-2021-44312

The CVE-2021-44312 entry affects Firmware Analysis and Comparison Tool (FACT) version 3.2. A cross-site request forgery (CSRF) vulnerability exists in the web application, stemming from insufficient validation that requests originate from trusted users. Consequence: logged-in administrators could...

CVE-2021-44310

Summary: CVE-2021-44310 affects Firmware Analysis and Comparison Tool (FACT) v3.2. With administrator privileges, an attacker can perform stored XSS by injecting JavaScript/HTML through the user creation functionality. The vulnerability arises from insufficient data validation/filtering of user-s...

CVE-2020-11499

FACT 3 from Firmware Analysis and Comparison Tool shows a Stored XSS vulnerability when updating analysis details via a localhost web request, caused by mishandling of the tags and version fields in helperFunctions/mongo_task_conversion.py. This is corroborated by multiple CVE references (NVD, Re...