Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Journyx Component: Journyx Clear all filters
TI-2024-06393 CVE-2024-6893 · GHSA-9hxq-vv35-9r5r

Journyx Unauthenticated XML External Entities Injection

Priority HIGH 72

The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.32916 Published 2024-08-07 No fix listed CWE-611
TI-2024-06392 CVE-2024-6892 · GHSA-cg3x-qc2c-6jq2

Journyx Reflected Cross Site Scripting

Priority MEDIUM 60

Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0075 Published 2024-08-07 No fix listed CWE-81
TI-2024-06391 CVE-2024-6891 · GHSA-hp2r-hjvj-mq3f

Journyx Authenticated Remote Code Execution

Priority HIGH 73

Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00953 Published 2024-08-07 No fix listed CWE-94
TI-2024-06390 CVE-2024-6890 · GHSA-4rc5-7v2h-gq36

Journyx Unauthenticated Password Reset Bruteforce

Priority HIGH 82

Password reset tokens are generated using an insecure source of randomness.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00717 Published 2024-08-07 No fix listed CWE-321