CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8016
https://notcve.org/view.php?id=CVE-2017-8016
11 Oct 2017 — RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Questionnaire ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application. La plataforma RSA Archer GRC en versiones anteriores a la 6.2.0.5 se ve afectada por Cross-Site Scripting (XSS) persistente mediante el campo Questionnaire ID. Un atacante autenticado podría explotarlo para ejecutar código HTML ar... • http://seclists.org/fulldisclosure/2017/Oct/12 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8025 – RSA Archer GRC 6.2.0.5 XSS / File Upload / Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-8025
06 Oct 2017 — RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to upload malicious files via attachments to arbitrary paths on the web server. La plataforma RSA Archer GRC en versiones anteriores a la 6.2.0.5 se ve afectada por una vulnerabilidad de subida de archivos arbitrarios. Un atacante remoto no autenticado podría explotar esta vulnerabilidad para subir archivos maliciosos mediante archivos a... • http://seclists.org/fulldisclosure/2017/Oct/12 • CWE-20: Improper Input Validation •