A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing a JavaScript payload, or a victim can be socially engineered to import a malicious report template. When the victim views or imports the report, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.
oryginał ENCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNozominetworks Cmc
APPNozominetworks< 25.5.0Nozominetworks Guardian
APPNozominetworks< 25.5.0
Powiązane podatności
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain...
A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient...
An access control vulnerability was discovered in the CLI functionality due to a specific access restriction n...
A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input...
A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of t...