Search criteria

18 vulnerabilities found for smartertrack by smartertools

FKIE_CVE-2022-24387

Vulnerability from fkie_nvd - Published: 2022-03-14 13:15 - Updated: 2024-11-21 06:50
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010
References
csirt@divd.nlhttps://csirt.divd.nl/CVE-2022-24387/
csirt@divd.nlhttps://csirt.divd.nl/DIVD-2021-00029Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://csirt.divd.nl/DIVD-2021-00029Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://csrit.divd.nl/CVE-2022-24387
Impacted products
Vendor Product Version
smartertools smartertrack *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9341A22E-DFC2-49E6-82B3-48C692AAFF7E",
              "versionEndExcluding": "100.0.8075",
              "versionStartIncluding": "100.0.8019",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010"
    },
    {
      "lang": "es",
      "value": "Con privilegios de administrador o de administrador puede enga\u00f1arse a la aplicaci\u00f3n para que sobrescriba los archivos de la carpeta app_data/Config, por ejemplo, el archivo systemsettings.xml. Esto es posible en SmarterTrack versi\u00f3n v100.0.8019.14010"
    }
  ],
  "id": "CVE-2022-24387",
  "lastModified": "2024-11-21T06:50:18.887",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "csirt@divd.nl",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-14T13:15:07.943",
  "references": [
    {
      "source": "csirt@divd.nl",
      "url": "https://csirt.divd.nl/CVE-2022-24387/"
    },
    {
      "source": "csirt@divd.nl",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/DIVD-2021-00029"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/DIVD-2021-00029"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://csrit.divd.nl/CVE-2022-24387"
    }
  ],
  "sourceIdentifier": "csirt@divd.nl",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "csirt@divd.nl",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2022-24384

Vulnerability from fkie_nvd - Published: 2022-03-14 13:15 - Updated: 2024-11-21 06:50
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.
References
csirt@divd.nlhttps://csirt.divd.nl/CVE-2022-24384Third Party Advisory, VDB Entry
csirt@divd.nlhttps://csirt.divd.nl/DIVD-2021-00029Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://csirt.divd.nl/CVE-2022-24384Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://csirt.divd.nl/DIVD-2021-00029Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
smartertools smartertrack *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D99A4E2-B4EA-484B-A591-F8D481FDE85A",
              "versionEndExcluding": "100.0.8075",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo Cross-site Scripting (XSS) en SmarterTools SmarterTrack Este problema afecta a: SmarterTools SmarterTrack versi\u00f3n 100.0.8019.14010"
    }
  ],
  "id": "CVE-2022-24384",
  "lastModified": "2024-11-21T06:50:18.507",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "csirt@divd.nl",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-14T13:15:07.770",
  "references": [
    {
      "source": "csirt@divd.nl",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/CVE-2022-24384"
    },
    {
      "source": "csirt@divd.nl",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/DIVD-2021-00029"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/CVE-2022-24384"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/DIVD-2021-00029"
    }
  ],
  "sourceIdentifier": "csirt@divd.nl",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "csirt@divd.nl",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2022-24386

Vulnerability from fkie_nvd - Published: 2022-03-14 13:15 - Updated: 2024-11-21 06:50
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.
References
csirt@divd.nlhttps://csirt.divd.nl/CVE-2022-24386Third Party Advisory, VDB Entry
csirt@divd.nlhttps://csirt.divd.nl/DIVD-2021-00029Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://csirt.divd.nl/CVE-2022-24386Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://csirt.divd.nl/DIVD-2021-00029Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
smartertools smartertrack *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C7332AA-EE48-4DFC-A6F3-30B95ACDBAF4",
              "versionEndExcluding": "100.0.8075",
              "versionStartIncluding": "100.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo XSS almacenado en SmarterTools SmarterTrack Este problema afecta a: SmarterTools SmarterTrack versi\u00f3n 100.0.8019.14010"
    }
  ],
  "id": "CVE-2022-24386",
  "lastModified": "2024-11-21T06:50:18.753",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "csirt@divd.nl",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-14T13:15:07.887",
  "references": [
    {
      "source": "csirt@divd.nl",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/CVE-2022-24386"
    },
    {
      "source": "csirt@divd.nl",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/DIVD-2021-00029"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/CVE-2022-24386"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/DIVD-2021-00029"
    }
  ],
  "sourceIdentifier": "csirt@divd.nl",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "csirt@divd.nl",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2022-24385

Vulnerability from fkie_nvd - Published: 2022-03-14 13:15 - Updated: 2024-11-21 06:50
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.
References
csirt@divd.nlhttps://csirt.divd.nl/CVE-2022-24385Third Party Advisory, VDB Entry
csirt@divd.nlhttps://csirt.divd.nl/DIVD-2021-00029Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://csirt.divd.nl/CVE-2022-24385Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://csirt.divd.nl/DIVD-2021-00029Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
smartertools smartertrack *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D99A4E2-B4EA-484B-A591-F8D481FDE85A",
              "versionEndExcluding": "100.0.8075",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Acceso Directo a Objetos en SmarterTools SmarterTrack conlleva a una divulgaci\u00f3n de informaci\u00f3n Este problema afecta a: SmarterTools SmarterTrack versi\u00f3n 100.0.8019.14010"
    }
  ],
  "id": "CVE-2022-24385",
  "lastModified": "2024-11-21T06:50:18.630",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "csirt@divd.nl",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-14T13:15:07.830",
  "references": [
    {
      "source": "csirt@divd.nl",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/CVE-2022-24385"
    },
    {
      "source": "csirt@divd.nl",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/DIVD-2021-00029"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/CVE-2022-24385"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://csirt.divd.nl/DIVD-2021-00029"
    }
  ],
  "sourceIdentifier": "csirt@divd.nl",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-425"
        }
      ],
      "source": "csirt@divd.nl",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-425"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2009-4994

Vulnerability from fkie_nvd - Published: 2010-08-25 20:00 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
References
cve@mitre.orghttp://holisticinfosec.org/content/view/123/45/
cve@mitre.orghttp://secunia.com/advisories/36172Vendor Advisory
cve@mitre.orghttp://www.smartertools.com/SmarterTrack/ReleaseNotes.aspxPatch
af854a3a-2127-422b-91ae-364da2661108http://holisticinfosec.org/content/view/123/45/
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36172Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspxPatch
Impacted products
Vendor Product Version
smartertools smartertrack *
smartertools smartertrack 3.0.3040
smartertools smartertrack 3.1.3050
smartertools smartertrack 3.1.3089
smartertools smartertrack 3.5.3126
smartertools smartertrack 3.5.3159
smartertools smartertrack 3.5.3167
smartertools smartertrack 3.6.3216
smartertools smartertrack 3.6.3217
smartertools smartertrack 3.6.3229
smartertools smartertrack 3.6.3246
smartertools smartertrack 3.6.3267
smartertools smartertrack 3.6.3274
smartertools smartertrack 3.6.3309
smartertools smartertrack 3.6.3355
smartertools smartertrack 3.6.3411
smartertools smartertrack 3.6.3413
smartertools smartertrack 4.0.3387
smartertools smartertrack 4.0.3399
smartertools smartertrack 4.0.3411
smartertools smartertrack 4.0.3413
smartertools smartertrack 4.0.3435
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CA91889-9A4A-4503-838F-2FCA70CC4A05",
              "versionEndIncluding": "4.0.3483",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.0.3040:*:*:*:*:*:*:*",
              "matchCriteriaId": "5612D314-4209-4138-9E90-073CBD51C22D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.1.3050:*:*:*:*:*:*:*",
              "matchCriteriaId": "08FD5A20-9990-4DCE-A4D8-78B29AEC02A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.1.3089:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD9F2F38-8CD0-4AE3-89C5-325EA44C740E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.5.3126:*:*:*:*:*:*:*",
              "matchCriteriaId": "7577A051-3BF4-4F66-88A9-BBD0098DAF85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.5.3159:*:*:*:*:*:*:*",
              "matchCriteriaId": "B172899C-38D6-4EF9-8F4A-96F433DBE992",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.5.3167:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF158B77-40B9-460C-A07B-B5CA5DC3D00D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3216:*:*:*:*:*:*:*",
              "matchCriteriaId": "C251BA53-384E-4AEC-8BAE-03D11F0E1FE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3217:*:*:*:*:*:*:*",
              "matchCriteriaId": "3342CE8A-B7BD-484E-9945-F96A888B8667",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3229:*:*:*:*:*:*:*",
              "matchCriteriaId": "762CB30A-08E3-47D5-98E8-88E7DC0091A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3246:*:*:*:*:*:*:*",
              "matchCriteriaId": "99070B5B-62FC-4BF8-9DF1-A38ED82499FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3267:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5D0005F-A3B3-45E9-B95C-19B5939DFE08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3274:*:*:*:*:*:*:*",
              "matchCriteriaId": "1445B14F-46B5-468D-8DB7-D8822A21E824",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3309:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C08A7B9-2198-4A88-A1BB-EC3E608315CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3355:*:*:*:*:*:*:*",
              "matchCriteriaId": "5CE2810D-614F-45E8-95A1-45CFC74566B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3411:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9BB578B-5AD9-4699-9E78-7BCC1B781CE4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3413:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A7A80AA-EFAD-418E-AE70-CF37EA5AAF09",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:4.0.3387:*:*:*:*:*:*:*",
              "matchCriteriaId": "7BFA2753-61BF-4C9A-9C98-77F04C421389",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:4.0.3399:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7844312-E7AE-4CCC-A870-0642380A70B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:4.0.3411:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE15EB80-8BDC-4D32-82D1-B1E3433B7E6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:4.0.3413:*:*:*:*:*:*:*",
              "matchCriteriaId": "987A95C5-EF82-4AA1-B3D9-33233B4402C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:4.0.3435:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1D2457B-A9CC-47FB-AC5D-E286A68ED4AC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en frmKBSearch.aspx en SmarterTools, SmarterTrack anterior a v4.0.3504 permite a atacantes remotos inyectar c\u00f3digo web o HTML a trav\u00e9s del par\u00e1metro de b\u00fasqueda."
    }
  ],
  "id": "CVE-2009-4994",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2010-08-25T20:00:16.237",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://holisticinfosec.org/content/view/123/45/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36172"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspx"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://holisticinfosec.org/content/view/123/45/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36172"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspx"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2009-4995

Vulnerability from fkie_nvd - Published: 2010-08-25 20:00 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the email address field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
References
cve@mitre.orghttp://secunia.com/advisories/36172Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36172Vendor Advisory
Impacted products
Vendor Product Version
smartertools smartertrack *
smartertools smartertrack 3.0.3040
smartertools smartertrack 3.1.3050
smartertools smartertrack 3.1.3089
smartertools smartertrack 3.5.3126
smartertools smartertrack 3.5.3159
smartertools smartertrack 3.5.3167
smartertools smartertrack 3.6.3216
smartertools smartertrack 3.6.3217
smartertools smartertrack 3.6.3229
smartertools smartertrack 3.6.3246
smartertools smartertrack 3.6.3267
smartertools smartertrack 3.6.3274
smartertools smartertrack 3.6.3309
smartertools smartertrack 3.6.3355
smartertools smartertrack 3.6.3411
smartertools smartertrack 3.6.3413
smartertools smartertrack 4.0.3387
smartertools smartertrack 4.0.3399
smartertools smartertrack 4.0.3411
smartertools smartertrack 4.0.3413
smartertools smartertrack 4.0.3435
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CA91889-9A4A-4503-838F-2FCA70CC4A05",
              "versionEndIncluding": "4.0.3483",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.0.3040:*:*:*:*:*:*:*",
              "matchCriteriaId": "5612D314-4209-4138-9E90-073CBD51C22D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.1.3050:*:*:*:*:*:*:*",
              "matchCriteriaId": "08FD5A20-9990-4DCE-A4D8-78B29AEC02A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.1.3089:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD9F2F38-8CD0-4AE3-89C5-325EA44C740E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.5.3126:*:*:*:*:*:*:*",
              "matchCriteriaId": "7577A051-3BF4-4F66-88A9-BBD0098DAF85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.5.3159:*:*:*:*:*:*:*",
              "matchCriteriaId": "B172899C-38D6-4EF9-8F4A-96F433DBE992",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.5.3167:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF158B77-40B9-460C-A07B-B5CA5DC3D00D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3216:*:*:*:*:*:*:*",
              "matchCriteriaId": "C251BA53-384E-4AEC-8BAE-03D11F0E1FE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3217:*:*:*:*:*:*:*",
              "matchCriteriaId": "3342CE8A-B7BD-484E-9945-F96A888B8667",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3229:*:*:*:*:*:*:*",
              "matchCriteriaId": "762CB30A-08E3-47D5-98E8-88E7DC0091A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3246:*:*:*:*:*:*:*",
              "matchCriteriaId": "99070B5B-62FC-4BF8-9DF1-A38ED82499FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3267:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5D0005F-A3B3-45E9-B95C-19B5939DFE08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3274:*:*:*:*:*:*:*",
              "matchCriteriaId": "1445B14F-46B5-468D-8DB7-D8822A21E824",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3309:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C08A7B9-2198-4A88-A1BB-EC3E608315CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3355:*:*:*:*:*:*:*",
              "matchCriteriaId": "5CE2810D-614F-45E8-95A1-45CFC74566B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3411:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9BB578B-5AD9-4699-9E78-7BCC1B781CE4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:3.6.3413:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A7A80AA-EFAD-418E-AE70-CF37EA5AAF09",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:4.0.3387:*:*:*:*:*:*:*",
              "matchCriteriaId": "7BFA2753-61BF-4C9A-9C98-77F04C421389",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:4.0.3399:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7844312-E7AE-4CCC-A870-0642380A70B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:4.0.3411:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE15EB80-8BDC-4D32-82D1-B1E3433B7E6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:4.0.3413:*:*:*:*:*:*:*",
              "matchCriteriaId": "987A95C5-EF82-4AA1-B3D9-33233B4402C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smartertools:smartertrack:4.0.3435:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1D2457B-A9CC-47FB-AC5D-E286A68ED4AC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the email address field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en frmTickets.aspx en SmarterTools SmarterTrack  anterior a v4.0.3504 permite a atacantes remotos inyectar secuencias de comandos web y HTML de su elecci\u00f3n a trav\u00e9s del campo \"email\". NOTA: el origen de esta informaci\u00f3n es desconocido. Los detalles han sido obtenidos a partir de terceros."
    }
  ],
  "id": "CVE-2009-4995",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2010-08-25T20:00:16.347",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36172"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36172"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2022-24387 (GCVE-0-2022-24387)

Vulnerability from cvelistv5 – Published: 2022-03-14 12:15 – Updated: 2025-03-11 13:39
VLAI?
Title
File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010
Summary
With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010
Severity ?
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
https://csirt.divd.nl/DIVD-2021-00029 x_refsource_CONFIRMrelated
https://csirt.divd.nl/CVE-2022-24387/ x_refsource_CONFIRMthird-party-advisory
Impacted products
Vendor Product Version
SmarterTools SmarterTrack Affected: 100.0.8019.x , < Build 8075 (custom)
Create a notification for this product.
Credits
Wietse Boonstra (DIVD) Finn van der Knaap (DIVD) Victor Gevers (DIVD)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "smartertrack",
            "vendor": "smartertools",
            "versions": [
              {
                "lessThan": "Build_8075 ",
                "status": "affected",
                "version": "100.0.8019.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-24387",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T15:40:24.373881Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:53.847Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:07:02.615Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "related",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/DIVD-2021-00029"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://csrit.divd.nl/CVE-2022-24387"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SmarterTrack",
          "vendor": "SmarterTools",
          "versions": [
            {
              "lessThan": "Build 8075",
              "status": "affected",
              "version": "100.0.8019.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Wietse Boonstra (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Finn van der Knaap (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Victor Gevers (DIVD)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-11T13:39:25.911Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM",
            "related"
          ],
          "url": "https://csirt.divd.nl/DIVD-2021-00029"
        },
        {
          "tags": [
            "x_refsource_CONFIRM",
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2022-24387/"
        }
      ],
      "source": {
        "advisory": "DIVD-2021-00029",
        "discovery": "INTERNAL"
      },
      "title": "File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2022-24387",
    "datePublished": "2022-03-14T12:15:59",
    "dateReserved": "2022-02-03T00:00:00",
    "dateUpdated": "2025-03-11T13:39:25.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24384 (GCVE-0-2022-24384)

Vulnerability from cvelistv5 – Published: 2022-03-14 00:00 – Updated: 2025-03-11 13:40
VLAI?
Title
Reflective XSS on SmarterTrack v100.0.8019.14010
Summary
Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-79 - Cross-site Scripting (XSS)
Assigner
References
https://csirt.divd.nl/DIVD-2021-00029 x_refsource_CONFIRMrelated
https://csirt.divd.nl/CVE-2022-24384 x_refsource_CONFIRMthird-party-advisory
Impacted products
Vendor Product Version
SmarterTools SmarterTrack Affected: 100.x , < Build 8075 (custom)
Create a notification for this product.
Credits
Wietse Boonstra (DIVD) Finn van der Knaap (DIVD) Victor Gevers (DIVD)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "smartertrack",
            "vendor": "smartertools",
            "versions": [
              {
                "lessThan": "100.0.8075",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-24384",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T15:43:20.098345Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:57.347Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:07:02.670Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "related",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/DIVD-2021-00029"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/CVE-2022-24384"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SmarterTrack",
          "vendor": "SmarterTools",
          "versions": [
            {
              "lessThan": "Build 8075",
              "status": "affected",
              "version": "100.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Wietse Boonstra (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Finn van der Knaap (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Victor Gevers (DIVD)"
        }
      ],
      "datePublic": "2022-03-10T23:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.\u003c/p\u003e"
            }
          ],
          "value": "Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-11T13:40:41.607Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM",
            "related"
          ],
          "url": "https://csirt.divd.nl/DIVD-2021-00029"
        },
        {
          "tags": [
            "x_refsource_CONFIRM",
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2022-24384"
        }
      ],
      "source": {
        "advisory": "DIVD-2021-00029",
        "discovery": "INTERNAL"
      },
      "title": "Reflective XSS on SmarterTrack v100.0.8019.14010",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2022-24384",
    "datePublished": "2022-03-14T00:00:00Z",
    "dateReserved": "2022-02-03T00:00:00",
    "dateUpdated": "2025-03-11T13:40:41.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24385 (GCVE-0-2022-24385)

Vulnerability from cvelistv5 – Published: 2022-03-14 00:00 – Updated: 2025-03-11 13:40
VLAI?
Title
Information disclosure via direct object access on SmarterTrack v100.0.8019.14010
Summary
A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-425 - Direct Request (Forced Browsing)
Assigner
References
https://csirt.divd.nl/DIVD-2021-00029 x_refsource_CONFIRMrelated
https://csirt.divd.nl/CVE-2022-24385 x_refsource_CONFIRMthird-party-advisory
Impacted products
Vendor Product Version
SmarterTools SmarterTrack Affected: 100.x , < Build 8075 (custom)
Create a notification for this product.
Credits
Wietse Boonstra (DIVD) Finn van der Knaap (DIVD) Victor Gevers (DIVD)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-24385",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T14:13:03.172916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:56.475Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:07:02.545Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "related",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/DIVD-2021-00029"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/CVE-2022-24385"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SmarterTrack",
          "vendor": "SmarterTools",
          "versions": [
            {
              "lessThan": "Build 8075",
              "status": "affected",
              "version": "100.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Wietse Boonstra (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Finn van der Knaap (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Victor Gevers (DIVD)"
        }
      ],
      "datePublic": "2022-03-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-425",
              "description": "CWE-425 Direct Request (Forced Browsing)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-11T13:40:44.472Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM",
            "related"
          ],
          "url": "https://csirt.divd.nl/DIVD-2021-00029"
        },
        {
          "tags": [
            "x_refsource_CONFIRM",
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2022-24385"
        }
      ],
      "source": {
        "advisory": "DIVD-2021-00029",
        "discovery": "INTERNAL"
      },
      "title": "Information disclosure via direct object access on SmarterTrack v100.0.8019.14010",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2022-24385",
    "datePublished": "2022-03-14T00:00:00Z",
    "dateReserved": "2022-02-03T00:00:00",
    "dateUpdated": "2025-03-11T13:40:44.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24386 (GCVE-0-2022-24386)

Vulnerability from cvelistv5 – Published: 2022-03-14 00:00 – Updated: 2025-03-11 13:40
VLAI?
Title
Stored XSS in SmarterTrack v100.0.8019.14010
Summary
Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-79 - Cross-site Scripting (XSS)
Assigner
References
https://csirt.divd.nl/DIVD-2021-00029 x_refsource_CONFIRMrelated
https://csirt.divd.nl/CVE-2022-24386 x_refsource_CONFIRMthird-party-advisory
Impacted products
Vendor Product Version
SmarterTools SmarterTrack Affected: 100.x , < Build 8075 (custom)
Create a notification for this product.
Credits
Wietse Boonstra (DIVD) Finn van der Knaap (DIVD) Victor Gevers (DIVD)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:07:02.529Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "related",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/DIVD-2021-00029"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/CVE-2022-24386"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SmarterTrack",
          "vendor": "SmarterTools",
          "versions": [
            {
              "lessThan": "Build 8075",
              "status": "affected",
              "version": "100.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Wietse Boonstra (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Finn van der Knaap (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Victor Gevers (DIVD)"
        }
      ],
      "datePublic": "2022-03-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-11T13:40:43.047Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM",
            "related"
          ],
          "url": "https://csirt.divd.nl/DIVD-2021-00029"
        },
        {
          "tags": [
            "x_refsource_CONFIRM",
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2022-24386"
        }
      ],
      "source": {
        "advisory": "DIVD-2021-00029",
        "discovery": "INTERNAL"
      },
      "title": "Stored XSS in SmarterTrack v100.0.8019.14010",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2022-24386",
    "datePublished": "2022-03-14T00:00:00Z",
    "dateReserved": "2022-02-03T00:00:00",
    "dateUpdated": "2025-03-11T13:40:43.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-4995 (GCVE-0-2009-4995)

Vulnerability from cvelistv5 – Published: 2010-08-25 19:00 – Updated: 2024-09-16 22:52
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the email address field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/36172 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:24:54.068Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "36172",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36172"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the email address field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2010-08-25T19:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "36172",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36172"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-4995",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the email address field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "36172",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36172"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-4995",
    "datePublished": "2010-08-25T19:00:00Z",
    "dateReserved": "2010-08-25T00:00:00Z",
    "dateUpdated": "2024-09-16T22:52:08.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-4994 (GCVE-0-2009-4994)

Vulnerability from cvelistv5 – Published: 2010-08-25 19:00 – Updated: 2024-09-16 23:25
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:24:53.968Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://holisticinfosec.org/content/view/123/45/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspx"
          },
          {
            "name": "36172",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36172"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2010-08-25T19:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://holisticinfosec.org/content/view/123/45/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspx"
        },
        {
          "name": "36172",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36172"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-4994",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://holisticinfosec.org/content/view/123/45/",
              "refsource": "MISC",
              "url": "http://holisticinfosec.org/content/view/123/45/"
            },
            {
              "name": "http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspx",
              "refsource": "CONFIRM",
              "url": "http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspx"
            },
            {
              "name": "36172",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36172"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-4994",
    "datePublished": "2010-08-25T19:00:00Z",
    "dateReserved": "2010-08-25T00:00:00Z",
    "dateUpdated": "2024-09-16T23:25:29.201Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24387 (GCVE-0-2022-24387)

Vulnerability from nvd – Published: 2022-03-14 12:15 – Updated: 2025-03-11 13:39
VLAI?
Title
File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010
Summary
With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010
Severity ?
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
https://csirt.divd.nl/DIVD-2021-00029 x_refsource_CONFIRMrelated
https://csirt.divd.nl/CVE-2022-24387/ x_refsource_CONFIRMthird-party-advisory
Impacted products
Vendor Product Version
SmarterTools SmarterTrack Affected: 100.0.8019.x , < Build 8075 (custom)
Create a notification for this product.
Credits
Wietse Boonstra (DIVD) Finn van der Knaap (DIVD) Victor Gevers (DIVD)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "smartertrack",
            "vendor": "smartertools",
            "versions": [
              {
                "lessThan": "Build_8075 ",
                "status": "affected",
                "version": "100.0.8019.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-24387",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T15:40:24.373881Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:53.847Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:07:02.615Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "related",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/DIVD-2021-00029"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://csrit.divd.nl/CVE-2022-24387"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SmarterTrack",
          "vendor": "SmarterTools",
          "versions": [
            {
              "lessThan": "Build 8075",
              "status": "affected",
              "version": "100.0.8019.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Wietse Boonstra (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Finn van der Knaap (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Victor Gevers (DIVD)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-11T13:39:25.911Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM",
            "related"
          ],
          "url": "https://csirt.divd.nl/DIVD-2021-00029"
        },
        {
          "tags": [
            "x_refsource_CONFIRM",
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2022-24387/"
        }
      ],
      "source": {
        "advisory": "DIVD-2021-00029",
        "discovery": "INTERNAL"
      },
      "title": "File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2022-24387",
    "datePublished": "2022-03-14T12:15:59",
    "dateReserved": "2022-02-03T00:00:00",
    "dateUpdated": "2025-03-11T13:39:25.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24384 (GCVE-0-2022-24384)

Vulnerability from nvd – Published: 2022-03-14 00:00 – Updated: 2025-03-11 13:40
VLAI?
Title
Reflective XSS on SmarterTrack v100.0.8019.14010
Summary
Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-79 - Cross-site Scripting (XSS)
Assigner
References
https://csirt.divd.nl/DIVD-2021-00029 x_refsource_CONFIRMrelated
https://csirt.divd.nl/CVE-2022-24384 x_refsource_CONFIRMthird-party-advisory
Impacted products
Vendor Product Version
SmarterTools SmarterTrack Affected: 100.x , < Build 8075 (custom)
Create a notification for this product.
Credits
Wietse Boonstra (DIVD) Finn van der Knaap (DIVD) Victor Gevers (DIVD)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "smartertrack",
            "vendor": "smartertools",
            "versions": [
              {
                "lessThan": "100.0.8075",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-24384",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T15:43:20.098345Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:57.347Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:07:02.670Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "related",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/DIVD-2021-00029"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/CVE-2022-24384"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SmarterTrack",
          "vendor": "SmarterTools",
          "versions": [
            {
              "lessThan": "Build 8075",
              "status": "affected",
              "version": "100.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Wietse Boonstra (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Finn van der Knaap (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Victor Gevers (DIVD)"
        }
      ],
      "datePublic": "2022-03-10T23:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.\u003c/p\u003e"
            }
          ],
          "value": "Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-11T13:40:41.607Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM",
            "related"
          ],
          "url": "https://csirt.divd.nl/DIVD-2021-00029"
        },
        {
          "tags": [
            "x_refsource_CONFIRM",
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2022-24384"
        }
      ],
      "source": {
        "advisory": "DIVD-2021-00029",
        "discovery": "INTERNAL"
      },
      "title": "Reflective XSS on SmarterTrack v100.0.8019.14010",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2022-24384",
    "datePublished": "2022-03-14T00:00:00Z",
    "dateReserved": "2022-02-03T00:00:00",
    "dateUpdated": "2025-03-11T13:40:41.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24385 (GCVE-0-2022-24385)

Vulnerability from nvd – Published: 2022-03-14 00:00 – Updated: 2025-03-11 13:40
VLAI?
Title
Information disclosure via direct object access on SmarterTrack v100.0.8019.14010
Summary
A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-425 - Direct Request (Forced Browsing)
Assigner
References
https://csirt.divd.nl/DIVD-2021-00029 x_refsource_CONFIRMrelated
https://csirt.divd.nl/CVE-2022-24385 x_refsource_CONFIRMthird-party-advisory
Impacted products
Vendor Product Version
SmarterTools SmarterTrack Affected: 100.x , < Build 8075 (custom)
Create a notification for this product.
Credits
Wietse Boonstra (DIVD) Finn van der Knaap (DIVD) Victor Gevers (DIVD)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-24385",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T14:13:03.172916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:56.475Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:07:02.545Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "related",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/DIVD-2021-00029"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/CVE-2022-24385"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SmarterTrack",
          "vendor": "SmarterTools",
          "versions": [
            {
              "lessThan": "Build 8075",
              "status": "affected",
              "version": "100.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Wietse Boonstra (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Finn van der Knaap (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Victor Gevers (DIVD)"
        }
      ],
      "datePublic": "2022-03-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-425",
              "description": "CWE-425 Direct Request (Forced Browsing)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-11T13:40:44.472Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM",
            "related"
          ],
          "url": "https://csirt.divd.nl/DIVD-2021-00029"
        },
        {
          "tags": [
            "x_refsource_CONFIRM",
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2022-24385"
        }
      ],
      "source": {
        "advisory": "DIVD-2021-00029",
        "discovery": "INTERNAL"
      },
      "title": "Information disclosure via direct object access on SmarterTrack v100.0.8019.14010",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2022-24385",
    "datePublished": "2022-03-14T00:00:00Z",
    "dateReserved": "2022-02-03T00:00:00",
    "dateUpdated": "2025-03-11T13:40:44.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24386 (GCVE-0-2022-24386)

Vulnerability from nvd – Published: 2022-03-14 00:00 – Updated: 2025-03-11 13:40
VLAI?
Title
Stored XSS in SmarterTrack v100.0.8019.14010
Summary
Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-79 - Cross-site Scripting (XSS)
Assigner
References
https://csirt.divd.nl/DIVD-2021-00029 x_refsource_CONFIRMrelated
https://csirt.divd.nl/CVE-2022-24386 x_refsource_CONFIRMthird-party-advisory
Impacted products
Vendor Product Version
SmarterTools SmarterTrack Affected: 100.x , < Build 8075 (custom)
Create a notification for this product.
Credits
Wietse Boonstra (DIVD) Finn van der Knaap (DIVD) Victor Gevers (DIVD)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:07:02.529Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "related",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/DIVD-2021-00029"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://csirt.divd.nl/CVE-2022-24386"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SmarterTrack",
          "vendor": "SmarterTools",
          "versions": [
            {
              "lessThan": "Build 8075",
              "status": "affected",
              "version": "100.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Wietse Boonstra (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Finn van der Knaap (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Victor Gevers (DIVD)"
        }
      ],
      "datePublic": "2022-03-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-11T13:40:43.047Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM",
            "related"
          ],
          "url": "https://csirt.divd.nl/DIVD-2021-00029"
        },
        {
          "tags": [
            "x_refsource_CONFIRM",
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2022-24386"
        }
      ],
      "source": {
        "advisory": "DIVD-2021-00029",
        "discovery": "INTERNAL"
      },
      "title": "Stored XSS in SmarterTrack v100.0.8019.14010",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2022-24386",
    "datePublished": "2022-03-14T00:00:00Z",
    "dateReserved": "2022-02-03T00:00:00",
    "dateUpdated": "2025-03-11T13:40:43.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-4995 (GCVE-0-2009-4995)

Vulnerability from nvd – Published: 2010-08-25 19:00 – Updated: 2024-09-16 22:52
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the email address field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/36172 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:24:54.068Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "36172",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36172"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the email address field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2010-08-25T19:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "36172",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36172"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-4995",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the email address field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "36172",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36172"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-4995",
    "datePublished": "2010-08-25T19:00:00Z",
    "dateReserved": "2010-08-25T00:00:00Z",
    "dateUpdated": "2024-09-16T22:52:08.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-4994 (GCVE-0-2009-4994)

Vulnerability from nvd – Published: 2010-08-25 19:00 – Updated: 2024-09-16 23:25
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:24:53.968Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://holisticinfosec.org/content/view/123/45/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspx"
          },
          {
            "name": "36172",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36172"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2010-08-25T19:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://holisticinfosec.org/content/view/123/45/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspx"
        },
        {
          "name": "36172",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36172"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-4994",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://holisticinfosec.org/content/view/123/45/",
              "refsource": "MISC",
              "url": "http://holisticinfosec.org/content/view/123/45/"
            },
            {
              "name": "http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspx",
              "refsource": "CONFIRM",
              "url": "http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspx"
            },
            {
              "name": "36172",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36172"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-4994",
    "datePublished": "2010-08-25T19:00:00Z",
    "dateReserved": "2010-08-25T00:00:00Z",
    "dateUpdated": "2024-09-16T23:25:29.201Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}