Filtered by vendor Quadbase Subscriptions
Filtered by product Espressreports Es Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-24984 1 Quadbase 1 Espressreports Es 2024-11-21 8.8 High
An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user into uploading malicious files to the web server.
CVE-2020-24983 1 Quadbase 1 Espressreports Es 2024-11-21 8.8 High
An issue was discovered in Quadbase EspressReports ES 7 Update 9. An unauthenticated attacker can create a malicious HTML file that houses a POST request made to the DashboardBuilder within the target web application. This request will utilise the target admin session and perform the authenticated request (to change the Dashboard name) as if the victim had done so themselves, aka CSRF.