CVE-2014-8557

CVE-2014-8557 : In the JExperts Channel Platform version 5.0.33_CCB, multiple stored XSS vulnerabilities exist. An attacker can inject arbitrary web script or HTML via the parameter usuario.nome in the action editarUsuario (to usuario.do) or via titulo.form in the action novoChamado (to ticket.do...

CVE-2014-8558

CVE-2014-8558 affects JExperts Channel Platform 5.0.33_CCB. The vulnerability is an authorization bypass where the attacker can tamper with GET parameters named action and key to escalate privileges. authenticated users with restricted access (e.g., read-only) can access other users’ requests or ...