Vulnerabilities

TI-2022-14112 CVE-2022-32458 · GHSA-g939-v35m-p2v6

Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection

LOW 35

Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01133 Published 2022-07-20 No fix listed CWE-611

TI-2022-14111 CVE-2022-32457 · GHSA-87ww-2p7v-mc8x

LOW 26

Digiwin BPM has inadequate filtering for URL parameter.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00839 Published 2022-07-20 No fix listed CWE-918

TI-2022-14110 CVE-2022-32456 · GHSA-hc3j-r3mx-p43j

MEDIUM 45

Digiwin BPM’s function has insufficient validation for user input.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01641 Published 2022-07-20 No fix listed CWE-89