N/A

Biscom Secure File Transfer is vulnerable to cross-site scripting in the File Name field. An authenticated user with permissions to upload or send files can populate this field with a filename that contains standard HTML scripting tags. The resulting script will evaluated by any other authenticated user who views the attacker-supplied file name. All versions of SFT prior to 5.1.1028 are affected. The fix version is 5.1.1028.

N/A

N/A

Biscom Secure File Transfer 跨站脚本漏洞

Biscom Secure File Transfer（SFT）是美国Biscom公司的一套基于Web的文件传输解决方案。该方案具有文件共享、创建工作区和自动清理文件等功能。 Biscom SFT 5.1.1028之前版本中的Package Name字段存在跨站脚本漏洞。远程攻击者可利用该漏洞注入任意的Web脚本或HTML。

N/A

N/A