CVE-2019-14478 - CVE House
Back to Database
Status published Medium CVE-2019-14478

AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability...

Vulnerability Description

AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript code in the context of the user's browser if the victim opens or searches for a node whose "Display Name" contains an XSS payload.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-14478

Credits & Attribution

No credits recorded in the NVD database.

References

More from adremsoft

View All →
CVE-2019-14483
AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. Every user can read...
High 8.8
CVE-2019-14482
AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability...
Critical 9.8
CVE-2019-14481
AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery (CSRF) vulnerability...
Medium 5.4
CVE-2019-14480
AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in...
Critical 9.8
CVE-2019-14479
AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution. In the NetCrunch...
High 8.8

Affected Vendor

Affected Software

netcrunch
Vulnerable Versions:
10.6.0.4587

Timeline

Official Publish: December 16th, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.