Vulnerabilities

TI-2021-15903 CVE-2021-38283 · GHSA-vrhq-hx93-3cxp

Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read…

LOW 38

Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read application log files containing sensitive information via a predictable /log URI.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02491 Published 2021-11-29 No fix listed CWE-306

TI-2021-15827 CVE-2021-38147 · GHSA-qx47-qw9g-58j7

Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download…

HIGH 65

Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to process…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.53008 Published 2021-11-29 No fix listed CWE-306

TI-2021-15826 CVE-2021-38146 · GHSA-r23x-gq8q-5637

The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows…

MEDIUM 47

The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.11914 Published 2021-11-22 No fix listed CWE-22

Vulnerabilities

Filters

Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read…

Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download…

The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows…