CVE-2021-44874

CVE-2021-44874 affects Dalmark Systems Systeam 2.22.8 build 1724. The issue is an insecure design in the BI report module, where the endpoint exposes direct SQL commands via POST data to assemble reports. This allows an authenticated user to submit a SQL prompt to the BI reporting endpoint, enabl...

CVE-2021-44877

CVE-2021-44877 affects Dalmark Systems Systeam 2.22.8 build 1724. A broken access control flaw allows an unauthenticated attacker to use an API endpoint to generate a temporary JWT token that references the correct tenant before authentication and to request system configuration parameters. This ...

CVE-2021-44876

Dalmark Systems Systeam 2.22.8 build 1724 ERP is vulnerable to User enumeration due to differing authentication messages during tenant/user validation, enabling a brute-force attack with valid users. Root cause: message-based user existence disclosure during tenant resolution. Impact is stated as...

CVE-2021-44875

CVE-2021-44875 affects Dalmark Systems Systeam 2.22.8 build 1724. The issue is a user-enumeration flaw in the password-recovery flow: the application returns messages that differ depending on whether a user exists, enabling a brute-force attack to identify valid users. The vulnerability is docume...