Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NGSurvey Enterprise 3.6.4 incorrect authorization exposes other users’ API keys and personal data
Vulnerability Description
Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms ( on Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users’ browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Data Illusion Zumbrunn NGSurvey Enterprise Edition 安全漏洞
Vulnerability Description
Data Illusion Zumbrunn NGSurvey Enterprise Edition是瑞士Data Illusion Zumbrunn公司的一个问卷调查与数据采集系统。 Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4版本存在安全漏洞，该漏洞源于调查内容和管理功能输出编码不当，可能导致存储型跨站脚本攻击。
CVSS Information
N/A
Vulnerability Type
N/A