CVE-2019-16414

Description

A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI.

Weakness classification

• nvd@nist.gov: CWE-79

Primary references

• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Exploit, Mailing List, Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory