Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Comarch Component: Erp Xl Clear all filters
TI-2023-04185 CVE-2023-4539 · GHSA-p74r-mvhv-7jx7

Hardcoded password in Comarch ERP XL

Priority LOW 33

Use of a hard-coded password for a special database account created during Comarch ERP XL installation allows an attacker to retrieve embedded sensitive data stored in the database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00515 Published 2024-02-15 No fix listed CWE-798
TI-2023-04184 CVE-2023-4538 · GHSA-4g2f-j53w-6jfc

Shared Key in Comarch ERP XL

Priority LOW 29

The database access credentials configured during installation are stored in a special table, and are encrypted with a shared key, same among all Comarch ERP XL client installations.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00362 Published 2024-02-15 No fix listed CWE-522
TI-2023-04183 CVE-2023-4537 · GHSA-58qw-vfcj-x2hg

Protocol Downgrade in Comarch ERP XL

Priority LOW 35

Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00611 Published 2024-02-15 No fix listed CWE-755