CVE-2020-16270

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of targeted application and perform phishing-related attacks. Vulnerable application used in more than 3000 organizations in different sectors from retail to industries.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bdu.fstec.ru/vul/2020-04623Third Party Advisory
https://github.com/Security-AVS/CVE-2020-16270Third Party Advisory
https://olimpoks.ru/oks/forum/olimpoks5.phpProduct, Vendor Advisory
https://bdu.fstec.ru/vul/2020-04623Third Party Advisory
https://github.com/Security-AVS/CVE-2020-16270Third Party Advisory
https://olimpoks.ru/oks/forum/olimpoks5.phpProduct, Vendor Advisory

Timeline

Published: Oct 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-162719.1The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to re CVE-2020-162729.1The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote a CVE-2020-162737.8In Arm software implementing the Armv8-M processors (all versions), the stack selection mechanism could be influenced by a stack-underflow a CVE-2020-162756.1A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitr CVE-2020-162768.8An SQL injection vulnerability in the Assets component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to CVE-2020-162778.8An SQL injection vulnerability in the Analytics component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker CVE-2020-162786.1A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary scr CVE-2020-162799.8The Kommbox component in Rangee GmbH RangeeOS 8.0.4 is vulnerable to Remote Code Execution due to untrusted user supplied input being passed CVE-2020-16285.3Juniper Networks Junos OS uses the 128.0.0.0/2 subnet for internal communications between the RE and PFEs. It was discovered that packets ut CVE-2020-162805.5Multiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials of users for several external facing admini CVE-2020-162817.8The Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to escape from the restricted environment and CVE-2020-162828.8In the default configuration of Rangee GmbH RangeeOS 8.0.4, all components are executed in the context of the privileged root user. This may