CVE-2020-35204

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the PolicyAuthority/Common/FolderControl.jsp file via the unqID parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communicationsExploit, Third Party Advisory
https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communicationsExploit, Third Party Advisory
https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communicationsExploit, Third Party Advisory
https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communicationsExploit, Third Party Advisory

Timeline

Published: Jan 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-352059.8Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal p CVE-2020-352066.1Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the brows CVE-2020-352075.7An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The PIN authenticatio CVE-2020-352085.7An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The password authenti CVE-2020-352097.5An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.CVE-2020-35216.5A vulnerability in a specific REST API of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to CVE-2020-352106.5A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessi CVE-2020-352117.5An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a target cluster via manipulation of the variable term CVE-2020-352138.1An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.CVE-2020-352148.1An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.CVE-2020-352156.5An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primiti CVE-2020-352165.9An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.