Tia Viewer
Monthly
Stored cross-site scripting in KGS Software tia Viewer prior to version 1.2.8 lets an authenticated user with access to the annotation API inject arbitrary JavaScript into a stickynote annotation; the payload executes in the browser of any user who later opens the document, putting that user's session at risk. Exploitation requires an attacker account able to create or edit annotations plus a victim who opens the document, so impact is confined to the victim's browser session. Severity is moderate (CVSS 5.1; assessed CVSS:3.1 7.1-style scope-changed vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), no public exploit code or active exploitation has been confirmed, and version 1.2.8 contains the fix.
Stored cross-site scripting in KGS Software tia Viewer prior to version 1.2.8 lets an authenticated user with access to the annotation API inject arbitrary JavaScript into a stickynote annotation; the payload executes in the browser of any user who later opens the document, putting that user's session at risk. Exploitation requires an attacker account able to create or edit annotations plus a victim who opens the document, so impact is confined to the victim's browser session. Severity is moderate (CVSS 5.1; assessed CVSS:3.1 7.1-style scope-changed vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), no public exploit code or active exploitation has been confirmed, and version 1.2.8 contains the fix.