PT-2019-14630
CVE-2019-16330
·
Publicado
2019-10-17
·
Atualizado
2019-10-21
Descrição por
CVSS 3.1
5.4
MédiaMétricasAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
NCH Express Accounts Accounting version 7.02
Description
The issue concerns a persistent cross-site scripting (XSS) flaw in the input fields for Invoices, Sales Orders, Items, Customers, and Quotes. An authenticated, unprivileged user can modify these fields to inject arbitrary JavaScript code.
Recommendations
For NCH Express Accounts Accounting version 7.02, consider restricting access to the input fields for Invoices, Sales Orders, Items, Customers, and Quotes to prevent arbitrary JavaScript injection until a patch is available.
Explorabilidade
Exploit
Correção
Impactos
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾