CVE-2022-27969

CVE-2022-27969 affects Cynet 360 Web Portal prior to v4.5. Root cause: exposed GetAllDeceptionUsers endpoint (/WebApp/DeceptionUser/GetAllDeceptionUsers) that allows retrieving a list of decoy users via a crafted GET request. Impact: unauthorized disclosure of decoy user data. Affected software: ...

CVE-2022-27967

CVE-2022-27967 affects Cynet 360 Web Portal versions prior to 4.5. The issue enables an unauthenticated/indirect access to a list of excluded files and profiles through a crafted GET request to the endpoint "/WebApp/SettingsExclusion/GetExclusionsProfiles". The exposed data comprises excluded fil...

CVE-2022-27968

Cynet 360 Web Portal prior to v4.5 is vulnerable. Affected component: the GET endpoint /WebApp/SettingsFileMonitor/GetFileMonitorProfiles allows attackers to access a list of monitored files and profiles through a crafted request. Root cause: insufficient access control on the GetFileMonitorProfi...