CVE-2024-46480

The CVE-2024-46480 entry concerns Venki Supravizio BPM up to version 18.0.1, where an NTLM hash leak could allow an authenticated attacker with Application Administrator access to escalate privileges on the host. Affected component: Venki Supravizio BPM; root cause: NTLM hash leakage used to esca...

CVE-2024-46480

An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privileges on the underlying host system...

CVE-2024-46479

Venki Supravizio BPM through 18.0.1 was discovered to contain an arbitrary file upload vulnerability. An authenticated attacker may upload a malicious file, leading to remote code execution...

CVE-2024-46480

An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privileges on the underlying host system...

Venki Supravizio BPM 安全漏洞

Venki Supravizio BPM is a process management solution from Venki Brazil. A security vulnerability exists in Venki Supravizio BPM version 18.1.1 and prior versions, which stems from an open redirection vulnerability in the login page that leads to reflective cross-site scripting...

CVE-2024-46481

The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS...

CVE-2024-46481

CVE-2024-46481 affects Venki Supravizio BPM up to version 18.1.1. The login page is vulnerable to an open redirect that leads to a reflected XSS. The available documents confirm the vulnerability type (open redirect) and its consequence (reflected XSS) but do not provide specific affected files, ...

Dashi Tongzhou AgileBPM 安全漏洞

Dashi Tongzhou AgileBPM is a fully open process solution from Dashi Tongzhou China. A security vulnerability exists in Dashi Tongzhou AgileBPM version 1.0.0, which stems from improper access control...

abraham3k (>=1.3.8 <=1.5.3), accutuning-helpers (>=1.0.32 <=1.0.33) +76 more potentially affected by CVE-2024-10073 via flair (>=0.10.0 <=0.9.0)

flair PYPI version =0.10.0, =1.3.8, =1.0.32, =0.0.1, =0.1.0, =0.0.6, =0.1.20, =0.1.0, =0.1.0, =0.0.1.1, =0.2.4, =0.1.1, =0.1.3 and more Source cves: CVE-2024-10073 Source advisory: SNYK:PYTHON-FLAIR-8230414...

CVE-2024-9971

The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents...

CVE-2024-9971

The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents...

CVE-2024-9970

The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie...

CVE-2024-9970

The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie...

CVE-2024-9971

The CVE-2024-9971 issue affects NewType’s FlowMaster BPM Plus. A flaw in the product’s specific query function fails to properly restrict user input, allowing SQL injection. This enables remote attackers with regular privileges to read, modify, or delete database contents. Documents cite a high-s...

CVE-2024-9971 NewType FlowMaster BPM Plus - SQL Injection

The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents...

CVE-2024-9971 NewType FlowMaster BPM Plus - SQL Injection

The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents...

CVE-2024-9970

CVE-2024-9970 concerns NewType’s FlowMaster BPM Plus, where a privilege-escalation flaw allows an attacker with regular privileges to tamper with a specific cookie to gain administrator rights. The CVSS-3.1 metrics indicate Network access, Low attack complexity, Privileges Required: Low, with Hig...

CVE-2024-9970 NewType FlowMaster BPM Plus - Privilege Escalation

The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie...

NewType FlowMaster BPM Plus SQL注入漏洞

NewType FlowMaster BPM Plus is a business process management system from NewType, a Chinese company. A SQL injection vulnerability exists in NewType FlowMaster BPM Plus, which arises from a specific query function that does not properly restrict user input, allowing a remote attacker with regular...

PT-2024-39968 · Newtype · Flowmaster Bpm Plus

Name of the Vulnerable Software and Affected Versions: FlowMaster BPM Plus affected versions not specified Description: The FlowMaster BPM Plus system from NewType has a privilege escalation issue. Remote attackers with regular privileges can elevate their privileges to administrator by tampering...