Vulnerabilities

TI-2021-16652 CVE-2021-39271 · GHSA-v6w5-67rj-72w9

OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE)…

MEDIUM 44

OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python code in the class attribute of a .bscw file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03679 Published 2021-08-30 No fix listed

TI-2021-14716 CVE-2021-36359 · GHSA-764h-r5xf-7cf5

OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution…

MEDIUM 45

OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (reached via bscw.cgi op=_editfolder.EditFolder) calls eval on…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03975 Published 2021-08-30 No fix listed CWE-91

TI-2014-01824 CVE-2014-2301 · GHSA-393q-2jgx-p9ph

OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the…

LOW 27

OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations (op=inf) to an object in pub/bscw.cgi/.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02253 Published 2014-05-12 No fix listed CWE-200

Vulnerabilities

Filters

OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE)…

OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution…

OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the…