eramba vulnerabilities

Products

• eramba 4

Latest eramba CVEs

Newest publication first

1. CVE-2018-7997 Eramba e1.0.6.033 has Reflected XSS on the Error page of the CSV file inclusion tab of the /importTool/preview URI, with a CSV file polluted with malicious JavaScript.

   Published 2018-03-09

   Medium·CVSS 6.1

   Eramba e1.0.6.033 has Reflected XSS on the Error page of the CSV file inclusion tab of the /importTool/preview URI, with a CSV file polluted with malicious JavaScript.

2. CVE-2018-7996 Eramba e1.0.6.033 has Stored XSS on the tooltip box via the /programScopes description parameter.

   Published 2018-03-09

   Medium·CVSS 6.1

   Eramba e1.0.6.033 has Stored XSS on the tooltip box via the /programScopes description parameter.

3. CVE-2018-7894 Eramba e1.0.6.033 has Reflected XSS in reviews/filterIndex/ThirdPartyRiskReview via the advanced_filter parameter (aka the Search Parameter).

   Published 2018-03-09

   Medium·CVSS 6.1

   Eramba e1.0.6.033 has Reflected XSS in reviews/filterIndex/ThirdPartyRiskReview via the advanced_filter parameter (aka the Search Parameter).

4. CVE-2018-7741 Eramba e1.0.6.033 has Reflected XSS in the Date Filter via the created parameter to the /crons URI.

   Published 2018-03-07

   Medium·CVSS 6.1

   Eramba e1.0.6.033 has Reflected XSS in the Date Filter via the created parameter to the /crons URI.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.