Administrator session compromise via stored and reflected XSS

Cross-site scripting in Tufin SecureTrack before R20-2 GA allows attackers to execute stored or reflected script in an administrator's browser. The affected input is returned without safe output handling and is also stored in the database for later rendering, but the public record does not name the parameter or endpoint. Exploitation requires an administrator to render the injected value; unauthenticated and low-privileged attackers can supply it, enabling actions with the administrator's session.