Vulnerabilities

Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed Server" to which this client connects.

In the "bestinformed Web" application, some user input was not properly sanitized.

In the "bestinformed Web" application, some user input was not properly sanitized.

An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application.

Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patterns.

The Scripting and AutoUpdate functionality in Cordaware bestinformed Microsoft Windows client versions before 6.2.1.0 are affected by insecure implementations which allow remote attackers to execute arbitrary commands an…