18 matches found
CVE-2026-5414
A security flaw has been discovered in Newgen OmniDocs up to 12.0.00. Affected by this issue is some unknown functionality of the file /omnidocs/WebApiRequestRedirection. The manipulation of the argument DocumentId results in improper control of resource identifiers. The attack may be performed...
CVE-2026-5414 Newgen OmniDocs WebApiRequestRedirection resource injection
A security flaw has been discovered in Newgen OmniDocs up to 12.0.00. Affected by this issue is some unknown functionality of the file /omnidocs/WebApiRequestRedirection. The manipulation of the argument DocumentId results in improper control of resource identifiers. The attack may be performed...
CVE-2026-5414
A security flaw has been discovered in Newgen OmniDocs up to 12.0.00. Affected by this issue is some unknown functionality of the file /omnidocs/WebApiRequestRedirection. The manipulation of the argument DocumentId results in improper control of resource identifiers. The attack may be performed...
CVE-2026-5414: Improper Control of Resource Identifiers
A security flaw has been discovered in Newgen OmniDocs up to 12.0.00. Affected by this issue is some unknown functionality of the file /omnidocs/WebApiRequestRedirection. The manipulation of the argument DocumentId results in improper control of resource identifiers. The attack may be performed...
EUVD-2020-18796
Malware in sbrugna...
EUVD-2023-48260
Malicious code in bioql PyPI...
CVE-2023-43900
CVE-2023-43900 affects EMSigner v2.8.7 with an insecure direct object reference (IDOR) vulnerability. The issue allows an attacker to gain unauthorized access to application content and view sensitive data of other users by manipulating the documentID and EncryptedDocumentId parameters. The provi...
CVE-2023-43900: Authorization Bypass Through User-Controlled Key
Insecure Direct Object References IDOR in eMudhra emSigner v2.8.7 allow authenticated attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters...
PT-2023-29037
Name of the Vulnerable Software and Affected Versions EMSigner version 2.8.7 Description The issue allows attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters. This is due to...
Code injection
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them...
Improper access control
An issue was discovered in tangro Business Workflow before 1.18.1. No or broken access control checks exist on the /api/document//attachments API endpoint. Knowing a document ID, an attacker can list all the attachments of a workitem, including their respective IDs. This allows the attacker to...
CVE-2020-26171
CVE-2020-26171 affects tangro Business Workflow prior to 1.18.1. The vulnerability arises from manipulation of the documentId in attachments uploaded via /api/document/attachments/upload, allowing a user to add attachments to workitems that do not belong to them. The provided documents do not spe...
PT-2020-16331
Name of the Vulnerable Software and Affected Versions tangro Business Workflow versions prior to 1.18.1 Description An issue exists where no or broken access control checks are in place on the "/api/document//attachments" API endpoint. This allows an attacker, knowing a document ID, to list all...
PT-2020-16326
Name of the Vulnerable Software and Affected Versions tangro Business Workflow versions prior to 1.18.1 Description The issue allows users to manipulate the documentId of attachment uploads to the "/api/document/attachments/upload" API endpoint. This manipulation enables users to add attachments ...
CVE-2020-26171: Authorization Bypass Through User-Controlled Key
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them...
CVE-2017-14758: Improper Neutralization of Special Elements used in an SQL Command
OpenText Document Sciences xPression formerly EMC Document Sciences xPression v4.5SP1 Patch 13 older versions might be affected as well is prone to SQL Injection: /xAdmin/html/cmdoclistviewuc.jsp, parameter: documentId. In order for this vulnerability to be exploited, an attacker must authenticat...
PT-2017-13673
Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13 Description The issue allows for SQL Injection, specifically through the /xAdmin/html/cm doclist view uc.jsp API endpoint, with the vulnerable parameter being documentId. ...
