KnowBe4 Security Awareness Training

• CVE-2020-36844 Medium 6.1 The KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The response has a SCRIPT element that sets window.location.href to a JavaScript URL. 0.3%
• CVE-2020-36845 Medium 5.3 The KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect function that does not validate the destination URL before redirecting. The response has a SCRIPT element that 0.3%