CVE-2019-11232

Summary of CVE-2019-11232 : Affected product is EXCELLENT INFOTEK BiYan versions 1.57 through 2.8. A vulnerability allows an unauthenticated attacker to disclose a password by sending an EMP_NO element to the kws_login/asp/query_user.asp URI and reading the PWD element. This results in informatio...

CVE-2019-11233

CVE-2019-11233 affects EXCELLENT INFOTEK BiYan v1.57–v2.8. A misdesign allows an unauthenticated attacker to leak user information by sending a LOGIN_ID element to the endpoint auth/main/asp/check_user_login_info.aspx and reading the response, with leakage demonstrated via KW_EMAIL or KW_TEL fiel...