CVE-2019-10012

CVE-2019-10012 affects Jenzabar JICS (Internet Campus Solution) prior to version 9. An attacker can upload and execute arbitrary .aspx code by placing it in a ZIP archive and leveraging the MoxieManager (for .NET) plugin before 2.1.4 in the installation’s ICS\ICS.NET\ICSFileServer directory. The ...

CVE-2019-10011

CVE-2019-10011 affects Jenzabar JICS (Internet Campus Solution): ICS/StaticPages/AddTestUsers.aspx allows remote account creation with a password of 1234 prior to 2019-02-06. Connected sources (Red Hat, NVD, CVE lists) corroborate the same description. The documentation does not provide a patch v...

CVE-2020-8434

Jenzabar JICS (Internet Campus Solution) is affected by CVE-2020-8434 in versions prior to 9.0.1 Patch 3, 9.1 prior to 9.1.2 Patch 2, and 9.2 prior to 9.2.2 Patch 8. The issue is that session cookies are derived from the username via a PBKDF-based scheme and AES, with a hard-coded password used t...