CVE-2019-12163

GAT-Ship Web Module prior to 1.31 is vulnerable to information disclosure via the ws/gatshipWs.asmx/SqlVersion endpoint. The root cause is exposure of potentially sensitive data through that API call. Affected versions: earlier than 1.31. Remediation: upgrade to 1.31 or later; as a temporary cont...

CVE-2019-11028

GAT-Ship Web Module is vulnerable to an authenticated unrestricted file upload in the Documents area (uploadDocFile.aspx) on versions before 1.40. The root cause is an improper validation allowing uploading of any file type to the server, enabling potential arbitrary content handling. There is no...