Portabilis vulnerabilities

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (XSS) via the matricula_interna parameter in the educar_usuario_cad.php endpoint. This issue affects i-Educar: 2.10.0.

A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. The affected element is an unknown function of the file /registros-de-conteudos-por-disciplina/ of the component Registro das atividades. The manipulation of the argument Registro de atividades/Conteúdos results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 821342cd8d952e8bd214cb16145da785a92f5681. A patch should be applied to remediate this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output: only a minimal allowlist of basic formatting tags is kept and all attributes are stripped, so injected <script> or event-handler markup is removed and displayed as inert text."

A vulnerability was identified in Portabilis i-Diario up to 1.5.0. Impacted is an unknown function of the file /registros-de-conteudos-por-areas-de-conhecimento/ of the component Registro das atividades. The manipulation of the argument Registro de atividades/Conteúdos leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is 821342cd8d952e8bd214cb16145da785a92f5681. It is suggested to install a patch to address this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output: only a minimal allowlist of basic formatting tags is kept and all attributes are stripped, so injected <script> or event-handler markup is removed and displayed as inert text."

A vulnerability was found in Portabilis i-Diario 1.5.0. Impacted is an unknown function of the file /diario-de-observacoes/ of the component Observações. Performing a manipulation of the argument Descrição results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 821342cd8d952e8bd214cb16145da785a92f5681. It is suggested to install a patch to address this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output: only a minimal allowlist of basic formatting tags is kept and all attributes are stripped, so injected <script> or event-handler markup is removed and displayed as inert text."

A weakness has been identified in Portabilis i-Diario 1.5.0. This affects an unknown function of the file /justificativas-de-falta. Executing a manipulation of the argument Justificativa can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called 821342cd8d952e8bd214cb16145da785a92f5681. Applying a patch is advised to resolve this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output".

A security flaw has been discovered in Portabilis i-Diario 1.5.0. The impacted element is an unknown function of the file /conteudos. Performing a manipulation of the argument filter[by_description] results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named d076c112b45e3b3e41cbe11de27949b491d922c2. It is recommended to apply a patch to fix this issue. The vendor confirms: "The searched term is now rendered escaped in the autocomplete widget, and the content tags are rendered through output-escaped templates, so an injected payload is displayed as inert text instead of being executed."

A vulnerability was identified in Portabilis i-Diario 1.5.0. The affected element is an unknown function of the file app/uploaders/doc_uploader.rb of the component justificativas-de-falta Endpoint. Such manipulation of the argument Anexo leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is 6c529bb2d96130aa29533f49e204e86518e11fdd. It is best practice to apply a patch to resolve this issue. The vendor confirms: "The attachment uploader now rejects files whose declared content type indicates executable or markup content".