CVE-2020-7575

MEDIUM Year: 2020
CVSS v3 Score
6.1
Medium
CVSS v2 Score
4.3
Medium
Weakness Type
CWE-80
View all →

Vulnerability Description

A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cross-site scripting (XSS) vulnerability exists in the web server access log page of the affected devices that could allow an attacker to inject arbitrary JavaScript code via specially crafted GET requests. The code could be potentially executed later by another (privileged) user. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires no system privileges. An attacker could use the vulnerability to compromise the confidentiality and integrity of other users' web sessions.

Related Vulnerabilities

CVE-2003-5003

MEDIUM
CVSS:6.1(Medium)

A vulnerability was found in ISS BlackICE PC Protection. It has been rated as problematic. Affected by this issue is the Update Handler. The manipulation with an unknown input leads to cross site scri...

CWE-802003

CVE-2006-0149

MEDIUM
CVSS:6.1(Medium)

Cross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary web script or HTML via the message field.

CWE-802006

CVE-2008-10001

MEDIUM
CVSS:6.1(Medium)

A vulnerability, which was classified as problematic, has been found in Pro2col Stingray FTS. The manipulation of the argument Username leads to cross site scripting. The attack may be initiated remot...

CWE-802008

CVE-2016-9493

MEDIUM
CVSS:6.1(Medium)

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.lib.php file, upload file types are checked against a hard-co...

CWE-802016

CVE-2016-9500

MEDIUM
CVSS:6.1(Medium)

Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image) that are vulnerable t...

CWE-802016

CVE-2017-16015

MEDIUM
CVSS:6.1(Medium)

Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms ma...

CWE-802017