CVE-2018-18406

The CVE-2018-18406 issue affects Tufin SecureTrack 18.1 with TufinOS 2.16 build 1179(Final). The Audit Report module is vulnerable to a blind XXE when saving a new Best Practices Report via a crafted XML payload, causing restricted OS files to be exposed inside the report’s name data field. Affec...

CVE-2020-13462

CVE-2020-13462 concerns Tufin SecureChange. The vulnerability is an Insecure Direct Object Reference (IDOR) affecting all versions prior to R20-2 GA, allowing unintended access or disclosure via improper object reference handling. The issue is fixed in version R20-2 GA. Other connected documents ...

CVE-2020-13460

CVE-2020-13460 affects Tufin SecureTrack and describes Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in all versions prior to R20-2 GA. The NVD metrics show CVSS v3.1 base score 8.8 (HIGH) with network attack vector, low attack complexity, no privileges, and user interaction required...

CVE-2020-13461

CVE-2020-13461 applies to Tufin SecureTrack and concerns username enumeration affecting all versions. The available documents state that this vulnerability allows an attacker to enumerate usernames and that the vendor has decided not to fix it. The vendor’s response notes that the attack requires...

CVE-2020-13407

Tufin SecureTrack

CVE-2020-13408

The CVE-2020-13408 entry concerns Tufin SecureTrack (R20-2 GA). The vulnerability is a combined reflected and stored XSS, where payloads are reflected to users and stored in the DB, enabling repetition by the same or other users. The impact notes that an attacker—potentially non-authenticated or ...

CVE-2020-13409

CVE-2020-13409 affects Tufin SecureTrack (R20-2 GA). The issue combines reflected and stored cross-site scripting: payloads are reflected to the user and also stored in the database, enabling re-triggering by the same or other users. Documents indicate that an admin can be targeted and that malic...