Prise

11 CVEs across 1 Prise products. Browse Prise vulnerabilities, severities, and proof-of-concept exploits.

Prise products with known CVEs

ProductCVEs
Adas11
Prise CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2019-15089High8.82019-09-20An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator.
CVE-2019-15088Critical9.82019-09-20An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, under specific circumstances, it is possible to by…
CVE-2019-15087High7.22019-09-20An issue was discovered in PRiSE adAS 1.7.0. An authenticated user can change the function used to hash passwords to any function, leading to remote code execu…
CVE-2019-15086Medium6.12019-09-20An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a reflected XSS in the error message.
CVE-2019-15085High7.52019-09-20An issue was discovered in PRiSE adAS 1.7.0. The current database password is embedded in the change password form.
CVE-2019-14916Medium6.52019-09-20An issue was discovered in PRiSE adAS 1.7.0. A file's format is not properly checked, leading to an unrestricted file upload.
CVE-2019-14915Medium6.12019-09-20An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate.
CVE-2019-14914Critical9.12019-09-20An issue was discovered in PRiSE adAS 1.7.0. The path is not properly escaped in the medatadata_del method, leading to an arbitrary file read and deletion via…
CVE-2019-14913Medium5.42019-09-20An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel.
CVE-2019-14912Medium6.12019-09-20An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to an open redirect that leaks the session…
CVE-2019-14911Medium6.12019-09-20An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly escape output on error, leading to reflected XSS.