CVE-2020-35205

Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal ports and make outbound connections via the initFile.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

• CWE-918

• https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communicationsExploit, Third Party Advisory
• https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communicationsExploit, Third Party Advisory
• https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communicationsExploit, Third Party Advisory
• https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communicationsExploit, Third Party Advisory

Published

Jan 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-3520A vulnerability in Cisco Data Center Network Manager (DCNM) …5.5
• CVE-2020-35200Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spa…6.1
• CVE-2020-35201Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users…5.4
• CVE-2020-35202Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-acces…5.4
• CVE-2020-35203Reflected XSS in Web Compliance Manager in Quest Policy Auth…6.1
• CVE-2020-35204Reflected XSS in Quest Policy Authority version 8.1.2.200 al…6.1
• CVE-2020-35206Reflected XSS in Web Compliance Manager in Quest Policy Auth…6.1
• CVE-2020-35207An issue was discovered in the LogMein LastPass Password Man…5.7
• CVE-2020-35208An issue was discovered in the LogMein LastPass Password Man…5.7
• CVE-2020-35209An issue in Atomix v3.1.5 allows unauthorized Atomix nodes t…7.5
• CVE-2020-3521A vulnerability in a specific REST API of Cisco Data Center …6.5
• CVE-2020-35210A vulnerability in Atomix v3.1.5 allows attackers to cause a…6.5