EUVD-2020-18803

Malware in sbrugna...

CVE-2020-26178

In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authenticated...

CVE-2020-26174

tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. However, this restriction is enforced in the browser client-side and can be circumvented. This allows an attacker to upload any file as an...

Code injection

In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authenticated...

CVE-2020-26174: Unrestricted Upload of File with Dangerous Type

tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. However, this restriction is enforced in the browser client-side and can be circumvented. This allows an attacker to upload any file as an...

PT-2020-16333

Name of the Vulnerable Software and Affected Versions tangro Business Workflow versions prior to 1.18.1 Description The issue allows unauthorized access to download workitem attachments by knowing the attachment ID, without requiring authentication. Recommendations For versions prior to 1.18.1,...

PT-2020-16329

Name of the Vulnerable Software and Affected Versions tangro Business Workflow versions prior to 1.18.1 Description The issue allows an attacker to upload any file as an attachment to a workitem, despite restrictions on filetypes. This is because the restriction is enforced in the browser, which...