CVE-2022-35554

CVE-2022-35554 affects BPC SmartVista v3.28.0. The issue is reflected XSS in error message handling that allows a remote attacker to execute JavaScript in the client browser. CVSSv3.1 base score 6.1 (Network, Low attack complexity, User interaction required, Confidentiality/Integrity impact Low)....

CVE-2022-38617

SmartVista SVFE2 v2.2.22 has a SQL injection vulnerability via the voiceAudit:j_id97 parameter at /SVFE2/pages/audit/voiceaudit.jsf. The issue stems from input handling allowing attacker-controlled SQL to affect the backend, with potential impact on confidentiality, integrity, and availability (C...

CVE-2022-38618

CVE-2022-38618 affects SmartVista SVFE2 v2.2.22. A SQL injection vulnerability exists in the web endpoint “/SVFE2/pages/feegroups/country_group.jsf” via the parameters UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92. The issue was described as enabling SQL injection, with the affected compo...

CVE-2018-15207

The CVE-2018-15207 entry concerns BPC SmartVista 2, specifically the SVFE module. Affected component: SVFE2/pages/finadmin/currconvrate/currconvrate.jsf. Root cause: Improper access control that allows a normal user to access functionality intended for admins. Impact stated in CVSS metrics is hig...

CVE-2018-15206

CVE-2018-15206 affects BPC SmartVista 2 with a CSRF flaw exposed at SVFE2/pages/admpages/roles/createrole.jsf. CVSSv3 indicates HIGH impact (8.8) with network attack, low complexity, no privileges, but requires user interaction; confidentiality, integrity, and availability are rated HIGH. No reme...

CVE-2018-15208

The CVE-2018-15208 entry concerns BPC SmartVista 2, where a Session Fixation vulnerability exists via the JSESSIONID parameter. According to the NVD record, the vulnerability has a CVSS v3 base score of 7.5 (HIGH) with NETWORK attack vector, HIGH attack complexity, no privileges required, user in...