GridTime 3000 vulnerabilities

The GridTime 3000 GNSS Time Server contains an open redirect vulnerability in the password change form submission. An attacker can exploit this flaw to redirect users to a malicious site after a password change.

A cross-site scripting (XSS) vulnerability was found in the GridTime 3000 password reset form due to improper input neutralization during web page generation. The issue affects versions from 1.0r0.03 before 1.2r0.0.

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This affects versions from 1.0r0.03 through 1.1r0.0.