CVE-2020-9405

CVE-2020-9405 affects IBL Online Weather prior to 4.3.5a. The vulnerability is an unauthenticated reflected XSS via the redirect page, stemming from insufficient input validation on client-side data; exploitation would enable running client-side scripts in the context of the affected site. No exp...

CVE-2020-9406

IBL Online Weather before 4.3.5a is affected by an unauthenticated eval injection via the Auxiliary Service’s queryBCP method. The vulnerability affects versions prior to 4.3.5a and stems from the queryBCP component allowing injection of code without authentication, enabling potential remote code...

CVE-2020-9407

IBL Online Weather prior to version 4.3.5a contains an information-disclosure vulnerability that allows an attacker to read the IWEBSERVICE_JSONRPC_COOKIE cookie and obtain sensitive data. The issue affects the software’s web-facing components and is fixed by upgrading to version 4.3.5a or later....