PatchTheCVEcompassplus vulnerabilities
Recent CVEs affecting compassplus products. 4 tracked.
compassplus has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2022-02-14. Highest priority: CVE-2021-28110 (score 47/100).
- CVE-2021-43106 MEDIUM 6.1 DOWNGRADE DOWNGRADE A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (
- CVE-2021-28126 MEDIUM 6.1 UPGRADE index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting
- CVE-2021-28110 HIGH 7.5 UPGRADE /exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser.
- CVE-2021-28109 MEDIUM 6.1 UPGRADE TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).
FAQ
How do I fix compassplus vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is compassplus being exploited right now?
None of the tracked compassplus CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which compassplus CVE should I patch first?
CVE-2021-28110 currently ranks highest (47/100): /exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser..