Total
6 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-14925 | 1 Matera | 1 Banco | 2019-10-02 | 7.5 HIGH | 9.8 CRITICAL |
| Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components. | |||||
| CVE-2018-14928 | 1 Matera | 1 Banco | 2018-10-11 | 7.8 HIGH | 7.5 HIGH |
| /contingency/servlet/ServletFileDownload executes as root and provides unauthenticated access to files via the file parameter. | |||||
| CVE-2018-14926 | 1 Matera | 1 Banco | 2018-10-02 | 6.8 MEDIUM | 8.8 HIGH |
| Matera Banco 1.0.0 allows CSRF, as demonstrated by a /contingency/web/messageSend/messageSendHandler.jsp request. | |||||
| CVE-2018-14927 | 1 Matera | 1 Banco | 2018-10-02 | 5.0 MEDIUM | 5.3 MEDIUM |
| Matera Banco 1.0.0 is vulnerable to path traversal (allowing access to system files outside the default application folder) via the /contingency/servlet/ServletFileDownload file parameter, related to /contingency/web/receiptQuery/receiptDisplay.jsp. | |||||
| CVE-2018-14929 | 1 Matera | 1 Banco | 2018-10-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp (aka home page) url parameter. | |||||
| CVE-2018-14924 | 1 Matera | 1 Banco | 2018-10-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" (aka user fullname) field. | |||||