Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Vendor: Business-DNA Solutions GmbH Clear all filters
TI-2021-18830 CVE-2021-42545 · GHSA-mqvw-2h8p-cf8g

Insufficient Session Expiration in TopEase

Priority MEDIUM 42

An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0114 Published 2021-11-30 No fix listed CWE-613
TI-2021-18829 CVE-2021-42544 · GHSA-jxgv-3jv5-8mh9

Lack of Rate limiting in Authentication in TopEase

Priority MEDIUM 45

Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on the Login Form allows an unauthenticated remote attacker to perform multiple login attempts, whi…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0141 Published 2021-11-30 No fix listed CWE-307
TI-2021-18631 CVE-2021-42123 · GHSA-2fvx-vhr6-r4cv

Missing Upload Filter in TopEase

Priority MEDIUM 40

Unrestricted File Upload in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 in the File Upload Functions allows an authenticated remote attacker with Upload privileges to u…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01055 Published 2021-11-30 No fix listed CWE-434
TI-2021-18630 CVE-2021-42122 · GHSA-7pq6-99v4-7fp6

Denial of Service via Invalid Object Attribute in TopEase

Priority LOW 21

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s attributes with numeric format allows an authenticated remote attacker with…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00773 Published 2021-11-30 No fix listed CWE-20
TI-2021-18629 CVE-2021-42121 · GHSA-52xf-jjg9-gfxx

Denial of Service via Invalid Date Format in TopEase

Priority LOW 22

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s date attribute(s) allows an authenticated remote attacker with Object Modifi…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01032 Published 2021-11-30 No fix listed CWE-20
TI-2021-18628 CVE-2021-42120 · GHSA-hjpq-rp56-x2qm

Missing Character Length (Denial of Service) in TopEase

Priority LOW 31

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on all object attributes allows an authenticated remote attacker with Object Modification p…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01101 Published 2021-11-30 No fix listed CWE-20
TI-2021-18627 CVE-2021-42119 · GHSA-3hxq-v55q-xvxq

Stored XSS in Search Function in TopEase

Priority LOW 33

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileg…

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.0053 Published 2021-11-30 No fix listed CWE-79
TI-2021-18626 CVE-2021-42118 · GHSA-qjch-qr2h-mw52

Stored XSS in TopEase

Priority LOW 36

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modificat…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00681 Published 2021-11-30 No fix listed CWE-79
TI-2021-18625 CVE-2021-42117 · GHSA-g32j-w768-4w3j

UI Redressing in TopEase

Priority LOW 26

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker with Object Modification privileges to insert arbit…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00729 Published 2021-11-30 No fix listed CWE-20
TI-2021-18624 CVE-2021-42116 · GHSA-m95m-2xc3-p525

Unauthorized Menu Item Access in TopEase

Priority LOW 22

Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker to view the Shape Editor and Settings, which are functio…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00831 Published 2021-11-30 No fix listed CWE-284
TI-2021-18623 CVE-2021-42115 · GHSA-hf8m-4ppx-hx3q

Missing HTTPOnly flag on sensitive cookie in TopEase

Priority MEDIUM 42

Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authentica…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01279 Published 2021-11-30 No fix listed CWE-1004