Two Factor Authentication Enterprise Server
Approved changes feed: RSS · Atom
cpe:2.3:a:wikidsystems:two_factor_authentication_enterprise_server:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Wikidsystems (d01efa35-fd99-5194-bbfb-53ed114b1a60) |
|---|---|
| Product | Two Factor Authentication Enterprise Server (e9b7fee7-c914-5ca5-bdf1-c6cf5cde9d81) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-17119 |
vulnerable | 2026-06-08 05:13:09.995703 |
Details available
Multiple SQL injection vulnerabilities in Logs.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allow authenticated users to execute arbitrary SQL commands via the source or subString parameter.
Published: 2019-10-17T18:08:05.000Z
Updated: 2024-08-05T01:33:16.879Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-17116 |
vulnerable | 2026-06-08 05:13:09.964403 |
Details available
A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/groups.jsp. The groupName parameter is vulnerable: the reflected cross-site scripting occurs immediately after the group is created. The malicious script is stored and will be executed again whenever /WiKIDAdmin/groups.jsp is visited.
Published: 2019-10-17T17:47:50.000Z
Updated: 2024-08-05T01:33:16.496Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-17115 |
vulnerable | 2026-06-08 05:13:09.964080 |
Details available
Multiple cross-site scripting (XSS) vulnerabilities in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML that is triggered when Logs.jsp is visited. The rendered_message column is retrieved and displayed, unsanitized, on Logs.jsp. A remote attack can populate the rendered_message column with malicious values via: (1) H parameter to /wikid/servlet/com.wikidsystems.server.GetDomainHash (2) S parameter to: - /wikid/DomainData - /wikid/PreRegisterLookup - /wikid/PreRegister - /wikid/InitDevice - /wikid/servlet/InitDevice2S - /wikid/servlet/InitDevice3S - /servlet/com.wikidsystems.server.InitDevice2S - /servlet/com.wikidsystems.server.InitDevice3S - /servlet/com.wikidsystems.server.InitDevice4S - /wikid/servlet/com.wikidsystems.server.InitDevice4AES - /wikid/servlet/com.wikidsystems.server.InitDevice5AES (3) a parameter to: - /wikid/PreRegisterLookup - /wikid/InitDevice - /wikid/servlet/InitDevice2S - /wikid/servlet/InitDevice3S - /servlet/com.wikidsystems.server.InitDevice2S - /servlet/com.wikidsystems.server.InitDevice3S - /servlet/com.wikidsystems.server.InitDevice4S - /wikid/servlet/com.wikidsystems.server.InitDevice4AES - /wikid/servlet/com.wikidsystems.server.InitDevice5AES.
Published: 2019-10-17T17:46:09.000Z
Updated: 2024-08-05T01:33:16.680Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-17114 |
vulnerable | 2026-06-08 05:13:09.963717 |
Details available
A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scripting occurs immediately after a .csv file is uploaded. The malicious script is stored and can be executed again when the List Pre-Registration functionality is used.
Published: 2019-10-17T17:44:18.000Z
Updated: 2024-08-05T01:33:17.058Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-16917 |
vulnerable | 2026-06-08 05:13:09.579433 |
Details available
WiKID Enterprise 2FA (two factor authentication) Enterprise Server through 4.2.0-b2047 is vulnerable to SQL injection through the searchDevices.jsp endpoint. The uid and domain parameters are used, unsanitized, in a SQL query constructed in the buildSearchWhereClause function.
Published: 2019-10-17T17:42:46.000Z
Updated: 2024-08-05T01:24:48.586Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.