jenzabar vulnerabilities

Products

• internet campus solution 3
• jenzabar 2

Latest jenzabar CVEs

Newest publication first

1. CVE-2021-26723 Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS.

   Published 2021-02-06

   Medium·CVSS 6.1 EPSS 12.6%

   Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS.

2. CVE-2020-8434 Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There i...

   Published 2020-05-19

   Critical·CVSS 9.8 EPSS 1.3%

   Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username...

3. CVE-2019-10012 Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a ZIP archive and using the MoxieManager (for .NET) plugin bef...

   Published 2019-03-25

   High·CVSS 7.5 EPSS 1.6%

   Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a ZIP archive and using the MoxieManager (for .NET) plugin before 2.1.4 in the moxiemanager directory within the installation folder ICS\ICS.N...

4. CVE-2019-10011 ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arbitrary number of accounts with a password of 1234.

   Published 2019-03-25

   Critical·CVSS 9.8 EPSS 2.1%

   ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arbitrary number of accounts with a password of 1234.

5. CVE-2018-16778 Cross-site scripting (XSS) vulnerability in Jenzabar v8.2.1 through 9.2.0 allows remote attackers to inject arbitrary web script or HTML via the query parameter (aka the Search Field).

   Published 2018-12-21

   Medium·CVSS 6.1 EPSS 0.81%

   Cross-site scripting (XSS) vulnerability in Jenzabar v8.2.1 through 9.2.0 allows remote attackers to inject arbitrary web script or HTML via the query parameter (aka the Search Field).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.