Threats tagged 'ghsa-q9pw-h7cq-jxq7'

WIT SynApps Runtime versions through 1.4.11 have a pre-authentication reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Exploitation can lead to credential harvesting, manipulation of the login process, access to browser-visible data, and same-origin requests to internal controller endpoints, including origin-switching in Cloud RIA scenarios.