CVE-2021-38283

Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read application log files containing sensitive information via a predictable /log URI...

CVE-2021-38147

Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...

Design/Logic Flaw

Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read application log files containing sensitive information via a predictable /log URI...

Design/Logic Flaw

Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...

CVE-2021-38283

Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read application log files containing sensitive information via a predictable /log URI...

CVE-2021-38283

CVE-2021-38283 affects Wipro Holmes Orchestrator 20.4.1, where remote attackers can read sensitive log files via a predictable /log URI. The connected sources corroborate a log information disclosure vulnerability in the 20.4.1 release; no specific patch/version or remediation details are provide...

CVE-2021-38147

Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...

CVE-2021-38147

Wipro Holmes Orchestrator 20.4.1 is affected by CVE-2021-38147, an information-disclosure vulnerability. Unauthenticated attackers can access API endpoints processexecution/DownloadExcelFile/{Domain_Credential_Report_Excel|User_Report_Excel|Process_Report_Excel|Infrastructure_Report_Excel|Resolve...

PT-2021-21967

Name of the Vulnerable Software and Affected Versions: Wipro Holmes Orchestrator version 20.4.1 20.4.1 02 11 2020 Description: The issue allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to...

CVE-2021-38283: Missing Authentication for Critical Function

Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read application log files containing sensitive information via a predictable /log URI...

CVE-2021-38147: Missing Authentication for Critical Function

Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...

Wipro Holmes Orchestrator Log Information Disclosure Vulnerability

Wipro Holmes Orchestrator is a one-stop application artificial intelligence Ai and automation platform orchestrator from Wipro India. version 20.4.1 of Wipro Holmes Orchestrator is vulnerable to log information disclosure, which can be exploited by unauthenticated attackers to access target log...

Wipro Holmes Orchestrator Access Control Error Vulnerability

Wipro Holmes Orchestrator, a one-stop application artificial intelligence Ai and automation platform orchestrator from Wipro India, is vulnerable to an access control error in Wipro Holmes Orchestrator version 20.4.1, which could be exploited by an unauthenticated attacker to download previously...

CVE-2021-38146

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

CVE-2021-38146

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

CVE-2021-38146

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

Path traversal

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

CVE-2021-38146

CVE-2021-38146 affects Wipro Holmes Orchestrator 20.4.1. The vulnerability is an unauthenticated, absolute path traversal in the File Download API (POST /home/download, SearchString parameter) that allows reading arbitrary server files. CVSS v3.1 base score 7.5 (HIGH) with network access, low att...

CVE-2021-38146

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

Wipro Holmes Orchestrator 20.4.1 File Disclosure

Exploit Title: Wipro Holmes Orchestrator 20.4.1 Unauthenticated Log File Disclosure Date: 09/08/2021 Exploit Author: Rizal Muhammed @ub3rsick Vendor Homepage: https://www.wipro.com/holmes/ Version: 20.4.1 Tested on: Windows 10 x64 CVE : CVE-2021-38283 import requests as rq import argparse import...