Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" (aka user fullname) field.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NMatera Banco
APPMatera1.0.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
Related vulnerabilities
CVE-2018-14925CRITICAL9.8PL ✓same product
Matera Banco — ujawnienie ścieżki stosu Java (stack trace) w backendzie
CVE-2018-14926HIGH8.8same product
Matera Banco 1.0.0 allows CSRF, as demonstrated by a /contingency/web/messageSend/messageSendHandler.jsp reque...
CVE-2018-14928HIGH7.5same product
/contingency/servlet/ServletFileDownload executes as root and provides unauthenticated access to files via the...
CVE-2018-14927MEDIUM5.3same product
Matera Banco 1.0.0 is vulnerable to path traversal (allowing access to system files outside the default applic...
CVE-2018-14929MEDIUM6.1same product
Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp ...