CVE-2025-66838

CVE-2025-66838 속도 제한 부재 - 파일 업로드 설명 공격자는 대량의 파일을 신속하게 업로드하여 서비스 거부를 유발할 수 있습니다 CVSS 점수: 6.5 중간 공격 유형 원격 인증됨 영향을 받는 버전 10.0.23.0.3587512 이하 버전 제품 공급업체 software ag 영향을 받는 제품 코드 베이스 ARIS 영향을 받는 구성 요소 파일 업로드 API. 완화 방안 업로드 API에 속도 제한을 구현하십시오. 취약점 세부 정보 파일 업로드 기능은 속도 제한 또는 스로틀링을 적용하지 않으므로 사용자는 제한 없이 파...

CVE-2025-66837

CVE-2025-66837 악성 파일 업로드 설명 ARIS의 파일 업로드 취약점으로 인해 공격자는 조작된 PDF 파일/악성코드를 업로드하여 임의 코드를 실행할 수 있습니다. CVSS 점수: 6.8 중간 공격 유형 원격 인증됨 영향받는 버전 10.0.23.0.3587512 이후 버전 발견자: Yazan Abu-Nadi...

CVE-2026-30250: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary code...

CVE-2026-8672: Use of Default Password

Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords. This issue affects Avantra: before 25.3.0...

CVE-2026-8671: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure. This issue affects Avantra: before 25.3.0...

CVE-2026-8670: Insufficient Session Expiration

Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs aka Session Replay. This issue affects Avantra: before 25.3.1...

PT-2026-42763

Name of the Vulnerable Software and Affected Versions Avantra versions prior to 25.3.0 Description An issue in syslink software AG Avantra on Linux and Windows allows the use of common or default usernames and passwords to gain unauthorized access. Recommendations Update to version 25.3.0 or late...

EUVD-2023-58802

Malicious code in bioql PyPI...

CVE-2024-23733

The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before CoreFix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the...

CVE-2023-6578

A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/. The manipulation leads to improper access controls. It is possible to launch the attack remotely. To access a file like /assets/ a popup...

CVE-2020-35469

The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed using affected versions of the Terracotta Server OSS container may allow a remote attacker to achieve root access with a blank password...

CVE-2024-23733

The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before CoreFix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the...

PT-2025-2365 · Software Ag · Webmethods

Name of the Vulnerable Software and Affected Versions: Software AG webMethods versions 10.15.0 before Core Fix7 Description: The issue allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to t...

CVE-2024-23733

The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before CoreFix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the...

CVE-2024-23733: Insufficiently Protected Credentials

The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before CoreFix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the...

CVE-2024-23733

Software AG webMethods API Integration Server version 10.15.0 (specifically version 10.15.0.0000-0092 ) is vulnerable to an Incorrect Access Control flaw. An attacker can reach the administration panel by sending an arbitrary username and a blank password to the /WmAdmin/#/login/ URI. This allows...

CVE-2024-23733

The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before CoreFix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the...

Software AG webMethods 安全漏洞

Software AG webMethods is Software AG's suite of integration and application development tools used to help organizations with tasks such as application integration, data integration, business process management, and application development. webMethods is designed to help organizations better...

ARIS: Business Process Management 10.0.21.0 Cross Site Scripting

Exploit Title: Stored Cross-Site Scripting XSS in ARIS: Business Process Management Edition Version 10.0.21.0 Exploit Author: Seid Yassin Date: 2024-03-28 Vendor: Software AG Software Link: https://aris.com/ Version: ARIS: Business Process Management Description: Discovered a file upload feature...

CVE-2023-6578

A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/. The manipulation leads to improper access controls. It is possible to launch the attack remotely. To access a file like /assets/ a popup...