CVE-2019-18265

Digital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The injected content is stored in logs and rendered when viewed in the web application.

Score

CVSS 3.1 5.4 Medium

Status

Modified - ics-cert@hq.dhs.gov

Published

2022-11-30

Last modified

2025-04-16

Weaknesses

CWE-79

Affected products

• Dasdec (Digital Alert Systems)
• Dasdec I Firmware (Digitalalertsystems)
• Dasdec Ii Firmware (Digitalalertsystems)
• Dasdec Iii Firmware (Digitalalertsystems)
• One-net Firmware (Digitalalertsystems)
• One-net Se Firmware (Digitalalertsystems)

References

• https://www.digitalalertsystems.com/security-advisory