CVE-2020-29539

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A Cross-Site Scripting (XSS) issue in WebUI Translation in Systran Pure Neural Server before 9.7.0 allows a threat actor to have a remote authenticated user run JavaScript from a malicious site.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://grave-rose.medium.com/two-systran-vulnerabilities-and-their-exploits-8bc83ba29e14Exploit, Third Party Advisory
https://www.systransoft.com/translation-products/systran-pure-neural-server/Product
https://grave-rose.medium.com/two-systran-vulnerabilities-and-their-exploits-8bc83ba29e14Exploit, Third Party Advisory
https://www.systransoft.com/translation-products/systran-pure-neural-server/Product

Timeline

Published: Dec 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-29546.1Vulnerability in the PeopleSoft Enterprise HRMS product of Oracle PeopleSoft (component: Candidate Gateway). The supported version that is a CVE-2020-295407.5API calls in the Translation API feature in Systran Pure Neural Server before 9.7.0 allow a threat actor to use the Systran Pure Neural Serv CVE-2020-295475.9An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3 STLS, IMAP STARTTLS,CVE-2020-295488.1An issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 S CVE-2020-29556.3Vulnerability in the Oracle FLEXCUBE Core Banking product of Oracle Financial Services Applications (component: Transaction Processing). The CVE-2020-295507.5An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection of the MS Office 365 CVE-2020-295519.1An issue was discovered in URVE Build 24.03.2020. Using the _internal/pc/shutdown.php path, it is possible to shutdown the system. Among oth CVE-2020-295529.8An issue was discovered in URVE Build 24.03.2020. By using the _internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0%3bpowershell+-c+" s CVE-2020-295538.8The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious CVE-2020-295558.1The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying CVE-2020-295565.5The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying se CVE-2020-295579.8An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attacker