Vulnerabilities

TI-2022-18172 CVE-2022-38619 · GHSA-x8p4-gq9j-2qj7

SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the…

HIGH 82

SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00922 Published 2022-09-20 No fix listed CWE-89

TI-2022-18171 CVE-2022-38618 · GHSA-wq8w-g496-v8vv

SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the…

LOW 39

SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/country_group.jsf.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00774 Published 2022-09-19 No fix listed CWE-89

TI-2022-18170 CVE-2022-38617 · GHSA-r9w6-4crr-3h35

SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the…

MEDIUM 40

SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the voiceAudit:j_id97 parameter at /SVFE2/pages/audit/voiceaudit.jsf.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00896 Published 2022-09-19 No fix listed CWE-89

TI-2022-18169 CVE-2022-38616 · GHSA-7h2g-gmgp-wxw8

SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the…

MEDIUM 40

SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00908 Published 2022-09-13 No fix listed CWE-89

TI-2022-18167 CVE-2022-38614 · GHSA-7488-qf6w-cjjc

An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0…

LOW 35

An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files via modifying the PATH parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01088 Published 2022-09-09 No fix listed CWE-22

TI-2022-18168 CVE-2022-38615 · GHSA-mcqw-chfj-8m42

SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities…

MEDIUM 40

SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/service_group.jsf.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00945 Published 2022-09-09 No fix listed CWE-89

TI-2022-18166 CVE-2022-38613 · GHSA-6pmf-x456-2247

A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated…

LOW 31

A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files in the system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01039 Published 2022-09-09 No fix listed CWE-22

TI-2022-16071 CVE-2022-35554 · GHSA-wv3h-vp77-x5r8

Multiple reflected XSS vulnerabilities occur when handling error message of BPC…

LOW 28

Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at client side.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0057 Published 2022-08-19 No fix listed CWE-79

TI-2018-10884 CVE-2018-15208 · GHSA-frmm-63vv-3hmg

BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter.

LOW 35

BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter.

CVSS 3.0HIGH 7.5 Network No auth User interaction EPSS 0.01127 Published 2019-04-30 No fix listed CWE-384

TI-2018-10883 CVE-2018-15207 · GHSA-3mjx-fvq9-8vm2

BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to…

LOW 34

BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pages/finadmin/currconvrate/currconvrate.jsf functionality that…

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01359 Published 2019-04-30 No fix listed CWE-269

TI-2018-10882 CVE-2018-15206 · GHSA-4hh4-mwxh-r3jg

BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf.

LOW 39

BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00636 Published 2019-04-30 No fix listed CWE-352

Vulnerabilities

Filters