Vulnerabilities

TI-2022-10185 CVE-2022-26959 · GHSA-r9xm-6r9g-xgp9

There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the…

MEDIUM 45

There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00931 Published 2022-09-16 No fix listed CWE-89

TI-2021-10129 CVE-2021-29398 · GHSA-79c8-pc25-j96r

Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp…

LOW 28

Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to browse and list the directories across the…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01785 Published 2022-02-04 No fix listed CWE-22

TI-2021-10128 CVE-2021-29397 · GHSA-4cw5-565x-w786

Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in…

LOW 34

Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local user to intercept users credentials transmitted in cleartext o…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00813 Published 2022-02-04 No fix listed CWE-319

TI-2021-10127 CVE-2021-29396 · GHSA-7fhj-r9fj-xv23

Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3…

MEDIUM 45

Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities without authentication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0167 Published 2022-02-04 No fix listed CWE-732

TI-2021-10126 CVE-2021-29395 · GHSA-pq4v-8cpp-x9jj

Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc…

LOW 36

Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to download arbitrary files, including JSP source code, across the…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01801 Published 2022-02-04 No fix listed CWE-22

TI-2021-10125 CVE-2021-29394 · GHSA-w4m5-jxqr-pf8g

Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc…

LOW 30

Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of prop…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00815 Published 2022-02-04 No fix listed CWE-863

TI-2021-10124 CVE-2021-29393 · GHSA-289g-75hj-mg9m

Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc…

MEDIUM 48

Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to inject and execute arbitrary system commands via the unsanitized…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03573 Published 2022-02-04 No fix listed CWE-78