Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: NewType Clear all filters
TI-2024-09254 CVE-2024-9971 · GHSA-2g6c-2vm9-2g8p

NewType FlowMaster BPM Plus - SQL Injection

Priority MEDIUM 41

The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00649 Published 2024-10-15 Fixed in 5.3.1 CWE-89
TI-2024-09253 CVE-2024-9970 · GHSA-7g9c-pfqm-8rrr

NewType FlowMaster BPM Plus - Privilege Escalation

Priority MEDIUM 41

The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00613 Published 2024-10-15 Fixed in 5.3.1 CWE-565
TI-2024-09252 CVE-2024-9969 · GHSA-pmw6-mg69-65jh

NewType WebEIP v3.0 - Reflected XSS

Priority LOW 24

NewType WebEIP v3.0 does not properly validate user input, allowing a remote attacker with regular privileges to insert JavaScript into specific parameters, resulting in a Reflected Cross-site Scripting (XSS) attack.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00286 Published 2024-10-15 No fix listed CWE-79
TI-2024-09251 CVE-2024-9968 · GHSA-q47f-prmv-x9hp

NewType WebEIP v3.0 - SQL injection

Priority MEDIUM 41

WebEIP v3.0 from NewType does not properly validate user input, allowing remote attackers with regular privilege to inject SQL commands to read, modify, and delete data stored in database.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00649 Published 2024-10-15 No fix listed CWE-89