CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43960
https://notcve.org/view.php?id=CVE-2021-43960
Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. Exploitation requires administrator privileges and is performed through the Wizard editor of the application. The attack requires an administrator to go into the Wizard editor and enter an XSS payload within the Page title, Page Instructions, Text before, Text after, or Text on side box. Once this has been done, the administrator must click save and finally wait until any user of the application performs a booking for rental items in the booking area of the application, where the XSS triggers. NOTE: another perspective is that the administrator may require JavaScript to customize any aspect of the page rendering. • https://www.lorensbergs.co.uk/products/connect2-academic https://www.surecloud.com/resources/blog/lorensbergs-connect2-cross-site-scripting • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-3742
https://notcve.org/view.php?id=CVE-2017-3742
In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two systems for the purpose of sharing files, the password for this ad-hoc connection will be stored in a user-readable location. An attacker with read access to the user's contents could connect to the Connect2 hotspot and see the contents of files while they are being transferred between the two systems. En las versiones de Lenovo Connect2 anteriores a 4.2.5.4885 para Windows y versión 4.2.5.3071 para Android, cuando una conexión ad-hoc se realiza entre dos sistemas con el fin de compartir archivos, la contraseña de esta conexión ad-hoc será almacenada en una ubicación legible por el usuario. Un atacante con acceso de lectura al contenido del usuario podría conectarse al punto de acceso Connect2 y visualizar el contenido de los archivos mientras estos son transferidos entre los dos sistemas. • https://support.lenovo.com/us/en/product_security/LEN-14398 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •