CVE-2020-14973
published 2020-06-22CVE-2020-14973: The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string.
PriorityP423medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.16%
63.1th percentile
The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| webtareas_project | webtareas | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
tiff vulnerabilities
osv·2023-02-02·CVSS 6.5
CVE-2019-14973 tiff vulnerabilities
tiff vulnerabilities
It was discovered that LibTIFF incorrectly handled certain malformed
images. If a user or automated system were tricked into opening a
specially crafted image, a remote attacker could crash the application,
leading to a denial of service, or possibly execute arbitrary code with
user privileges. This issue was only fixed in Ubuntu 14.04 ESM.
(CVE-2019-14973, CVE-2019-17546, CVE-2020-35523, CVE-2020-35524,
CVE-2022-3970)
It was discovered that LibTIFF was incorrectly acessing a data structure
when processing data with the tiffcrop tool, which could lead to a heap
buffer overflow. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2022-48281)
GHSA
GHSA-qrj8-qx9w-4g32: The loginForm within the general/login
ghsa_unreviewed·2022-05-24
CVE-2020-14973 [MEDIUM] GHSA-qrj8-qx9w-4g32: The loginForm within the general/login
The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-06-22
Published