Neeraj Kumar

The issue concerns a session fixation problem via the `JSESSIONID` parameter.

An issue exists in the Core and Portal modules, where an open redirect is possible via the "/IntellectMain.jsp?IntellectSystem=" URI.

The issue is related to a CSRF problem. It affects the `/SVFE2/pages/admpages/roles/createrole.jsf` API endpoint.

The issue is related to improper access control in the SVFE module. A normal user can access the "SVFE2/pages/finadmin/currconvrate/currconvrate.jsf" functionality, which should only be accessible to an admin.

An issue in the Armor module allows SQL injection with an authenticated session. This occurs because input passed through the `code` parameter in certain pages, such as "collaterals/colexe3t.jsp", "/references/refsuppu.jsp", and "/references/refbranu.jsp", is mishandled before being used in SQL queries.

A reflected XSS issue exists in the Core and Portal modules, which can be exploited with an authenticated session. The issue is related to the `Customerid`, `formName`, `FrameId`, or `MODE` parameters.

An issue was discovered in the Armor module, allowing CSRF to occur via the "/CollatWebApp/gcmsRefInsert?name=SUPP" URI.

The issue concerns a stored XSS vulnerability within the `Customers` function, specifically in the `Name` and `Note` sections, referred to as `custName` and `custNote`. The application fails to sanitize user-supplied input, allowing injected JavaScript code to be rendered in the user's browser.

The application is vulnerable to stored XSS within the "Add New" function for a Management User. The issue arises because the application does not sanitize user-supplied input to the `name` parameter, allowing injected JavaScript code to be rendered to the user's browser.

The issue concerns a Cross-Site Scripting (XSS) flaw. It is located in the `p name` field, also known as the Edit Category Name field, which is accessible through the "admin/categories industry.php" page, also referred to as Categories - Industry Type.