CVE-2023-32761

CVE-2023-32761 is a CSRF vulnerability in Archer Platform prior to version 6.13. An authenticated attacker can execute arbitrary code via a crafted request. The issue is fixed in Archer Platform versions 6.12.0.6 and 6.13.0. No exploitation details are provided beyond the authenticated vector; no...

CVE-2023-32760

CVE-2023-32760 affects Archer Platform prior to version 6.13, with fixes in 6.12.0.6 and 6.13.0. An authenticated attacker could access sensitive information via API calls related to data feeds and data publication. The vulnerability’s impact and exact exploited components are described in the li...

CVE-2024-26312

CVE-2024-26312 affects Archer Platform 6 prior to 2024.03. The vulnerability is described as a sensitive information disclosure that could be triggered by an authenticated user through a popup warning message, with the reported impact being partial disclosure of information (confidentiality: Low)...

CVE-2024-26310

Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability. A remote authenticated malicious user could exploit this to access API information that should only be accessible with extra privileges. The available sources describe the affected version range and t...

CVE-2024-41706

CVE-2024-41706 describes a stored XSS flaw in Archer Platform versions prior to 2024.06. A remote authenticated Archer user could store malicious HTML/JavaScript in a trusted application data store, which is then executed by victim users’ browsers in the vulnerable app context. Public details spe...

CVE-2024-41707

Archer Platform (v6) prior to 2024.06 is vulnerable to stored HTML content injection. Authenticated users can store malicious HTML in the trusted application data store, which is then executed by victim users’ browsers in the vulnerable app context. Remediation cited in available sources is to up...

CVE-2024-26313

Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored Cross-Site Scripting (XSS) vulnerability. A remote authenticated Archer user could store malicious HTML/JavaScript in a trusted data store, causing victim users’ browsers to execute code in the context of the vulnerable applica...

CVE-2024-41705

Archer Platform is affected by CVE-2024-41705: a stored XSS in the web data store allows a remote authenticated Archer user to store malicious HTML/JavaScript that executes in the browser context when other users view the data store. Affected versions include 6.8 prior to 2024.06, with fixed rele...

CVE-2024-34092

CVE-2024-34092 affects Archer Platform 6 before 2024.04. The issue is an authentication mishandling where a lock did not terminate an existing session, allowing continued access. A fixed release is 6.14 P3 (6.14.0.3) and later. The CVSS metrics indicate a high impact to confidentiality, integrity...

CVE-2024-34091

Archer Platform 6 before 2024.04 contains a stored XSS vulnerability in the trusted application data store. A remote authenticated Archer user can store malicious HTML/JS, which executes in other users’ browsers and can render content inaccessible. A fixed release exists: 6.14.0.3 (and later). Re...

CVE-2024-34090

CVE-2024-34090 affects Archer Platform 6 prior to 2024.04. The vulnerability is a stored cross-site scripting (XSS) flaw in the Archer Control Panel (ACP) login banner, where content was not properly escaped. This could allow an attacker with access to the ACP to inject and render malicious scrip...

CVE-2024-34093

Archer Platform 6 before 2024.03 is affected by an X-Forwarded-For Header Bypass vulnerability. The issue allows an unauthenticated attacker to bypass intended whitelisting when the X-Forwarded-For header is enabled. Affected software is Archer Platform (v6 prior to 2024.03); root cause is header...

CVE-2024-34089

CVE-2024-34089 concerns Archer Platform 6 prior to 2024.04 with a stored cross-site scripting (XSS) flaw. A remote authenticated Archer user can inject malicious HTML/JavaScript into a trusted application data store, which is then executed by victims’ browsers in the vulnerable app’s context. The...

CVE-2024-26311

Archer Platform 6.x before 6.14 P2 HF1 (6.14.0.2.1) is affected by a reflected XSS vulnerability. A remote authenticated Archer user could trick a victim application user into submitting malicious JavaScript to the vulnerable web app, which is then reflected back and executed in the browser conte...

CVE-2023-37223

CVE-2023-37223 affects Archer Platform. A Cross Site Scripting (XSS) vulnerability in versions prior to 6.13 allows a remote authenticated attacker to execute arbitrary code via a crafted script. The issue is mitigated by upgrading to Archer Platform 6.13.0 or later, and 6.12.0.6 is listed as a f...

CVE-2023-48641

CVE-2023-48641 affects Archer Platform 6.x prior to 6.14 P1 HF2 (6.14.0.1.2). The vulnerability is an insecure direct object reference that could allow an authenticated user in a multi‑instance deployment to bypass authorization by manipulating resource references in requests, gaining execute acc...

CVE-2023-37224

Archer Platform has a vulnerability (CVE-2023-37224) causing information disclosure via log files in versions prior to 6.13. It is fixed in 6.12.0.6 and 6.13.0. Upgrade to 6.12.0.6 or later (6.13.0 or newer) to remediate. The advisory does not specify exploitation details beyond authenticated acc...

CVE-2023-32759

CVE-2023-32759 (Archer Platform) : The affected product is Archer Platform, prior to version 6.13. The issue allows an authenticated attacker to obtain sensitive information through a crafted URL. The root cause is not detailed in the provided documents beyond this exposure path. A fixed version ...

CVE-2023-48642

CVE-2023-48642 affects Archer Platform 6.x up to 6.13 P2 (6.13.0.2). The issue is an authenticated HTML content injection vulnerability in the data store; a remote authenticated Archer user can store malicious HTML code in a trusted application data store, with victim users’ browsers executing it...