Simmeth
Simmeth Lieferantenmanager: vulnerabilidades y CVE
Simmeth Lieferantenmanager tiene 6 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE6
Últimos 12 meses0
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2022-44017 | Alta (7.5) | 0.72% | — | 25 dic 2022 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victim's account after the victim logged out - /LMS/LM/#main can be used for this.… |
| CVE-2022-44016 | Alta (7.5) | 0.88% | — | 25 dic 2022 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LM_API/api/ConfigurationService/GetImages with an… |
| CVE-2022-44015 | Crítica (9.8) | 1.2% | — | 25 dic 2022 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the… |
| CVE-2022-44014 | Media (6.5) | 0.75% | — | 25 dic 2022 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks all user passwords and MSSQL hashes via… |
| CVE-2022-44013 | Crítica (9.1) | 0.93% | — | 25 dic 2022 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authentication because the password in a Credential Object is not checked. |
| CVE-2022-44012 | Media (5.4) | 0.51% | — | 25 dic 2022 | An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6. An attacker can execute JavaScript code in the browser of the victim if a site… |