CVE-2021-38146

CVE-2021-38146 affects Wipro Holmes Orchestrator 20.4.1. The vulnerability is an unauthenticated, absolute path traversal in the File Download API (POST /home/download, SearchString parameter) that allows reading arbitrary server files. CVSS v3.1 base score 7.5 (HIGH) with network access, low att...

CVE-2021-38147

Wipro Holmes Orchestrator 20.4.1 is affected by CVE-2021-38147, an information-disclosure vulnerability. Unauthenticated attackers can access API endpoints processexecution/DownloadExcelFile/{Domain_Credential_Report_Excel|User_Report_Excel|Process_Report_Excel|Infrastructure_Report_Excel|Resolve...

CVE-2021-38283

CVE-2021-38283 affects Wipro Holmes Orchestrator 20.4.1, where remote attackers can read sensitive log files via a predictable /log URI. The connected sources corroborate a log information disclosure vulnerability in the 20.4.1 release; no specific patch/version or remediation details are provide...