41 matches found
CVE-2024-34321
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting XSS vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint...
CVE-2024-34326
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting XSS vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint...
CVE-2024-34323
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference IDOR via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request...
CVE-2024-34324
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NETSessionId cookie...
CVE-2024-34320
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints...
CVE-2024-34319
A Server-Side Request Forgery SSRF in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request...
CVE-2024-34323
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference IDOR via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request...
PT-2026-111638
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting XSS vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint...
PT-2026-111636
Name of the Vulnerable Software and Affected Versions ProPhoenix Law RMS version 2022.2403.3.101 Description An Insecure Direct Object Reference IDOR exists, which is a type of access control flaw where an application provides direct access to objects based on user-supplied input. This allows...
CVE-2024-34319
A Server-Side Request Forgery SSRF in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request...
CVE-2024-34319: Server-Side Request Forgery (SSRF)
A Server-Side Request Forgery SSRF in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request...
EUVD-2024-55793
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting XSS vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint...
PT-2026-111634
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints...
PT-2026-111637
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET SessionId cookie...
CVE-2024-34319
The ProPhoenix Law RMS version v2022.2403.3.101 is vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists in the serviceURL parameter, which allows an attacker to send a crafted HTTP request that forces the application server to perform unintended DNS and web requests . No specific ...
CVE-2024-34324
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows an attacker to perform a session hijacking attack . The vulnerability is caused by the ability to inject a crafted 24-character string into the ASP.NET_SessionId cookie. Exploitation details are not provided in the documents.
EUVD-2024-55795
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference IDOR via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request...
EUVD-2024-55796
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting XSS vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint...