Coins-global

Coins Construction Cloud

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2021-45227

Exploit
  • EPSS 0.21%
  • Veröffentlicht 14.04.2022 15:15:07
  • Zuletzt bearbeitet 21.11.2024 06:32:00

An issue was discovered in COINS Construction Cloud 11.12. Due to an inappropriate use of HTML IFRAME elements, the file upload functionality is vulnerable to a persistent Cross-Site Scripting (XSS) attack.

5.4

CVE-2021-45228

Exploit
  • EPSS 0.21%
  • Veröffentlicht 14.04.2022 15:15:07
  • Zuletzt bearbeitet 21.11.2024 06:32:00

An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task, it is possible to store malicious JavaScript code in the task description. This is later executed when it is...

8.8

CVE-2021-45222

Exploit
  • EPSS 0.43%
  • Veröffentlicht 24.01.2022 20:15:08
  • Zuletzt bearbeitet 21.11.2024 06:31:59

An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privilege escalation by HR personnel.

6.5

CVE-2021-45223

Exploit
  • EPSS 0.54%
  • Veröffentlicht 24.01.2022 20:15:08
  • Zuletzt bearbeitet 21.11.2024 06:31:59

An issue was discovered in COINS Construction Cloud 11.12. Due to insufficient input neutralization, it is vulnerable to denial of service attacks via forced server crashes.

6.1

CVE-2021-45224

Exploit
  • EPSS 0.4%
  • Veröffentlicht 24.01.2022 20:15:08
  • Zuletzt bearbeitet 21.11.2024 06:32:00

An issue was discovered in COINS Construction Cloud 11.12. In several locations throughout the application, JavaScript code is passed as a URL parameter. Attackers can trivially alter this code to cause malicious behaviour. The application is therefo...

6.1

CVE-2021-45225

Exploit
  • EPSS 0.4%
  • Veröffentlicht 24.01.2022 20:15:08
  • Zuletzt bearbeitet 21.11.2024 06:32:00

An issue was discovered in COINS Construction Cloud 11.12. Due to improper input neutralization, it is vulnerable to reflected cross-site scripting (XSS) via malicious links (affecting the search window and activity view window).

6.5

CVE-2021-45226

Exploit
  • EPSS 0.31%
  • Veröffentlicht 24.01.2022 20:15:08
  • Zuletzt bearbeitet 21.11.2024 06:32:00

An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause it to send password-reset e-mails pointing to arbitrary websites.