Vulnerabilities

TI-2023-04176 CVE-2023-4528 · GHSA-4r87-55rm-3493

JSCAPE MFT Server Unsafe Deserialization on Management Port

MEDIUM 58

Unsafe deserialization in JSCAPE MFT Server versions prior to 2023.1.9 (Windows, Linux, and MacOS) permits an attacker to run arbitrary Java code (including OS commands) via its management interface

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.3186 Published 2023-09-07 Fixed in 2023.1.9 CWE-502

TI-2021-08389 CVE-2021-26710 · GHSA-4vj5-f3fw-frfg

A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and…

LOW 38

A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript via the signIn.do urll parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.075 Published 2021-02-05 No fix listed CWE-79

TI-2021-08390 CVE-2021-26711 · GHSA-qh7g-hfr4-f2f4

A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote…

LOW 28

A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a frame via the help/Online_Help/NetHelp/default.htm turl parameter.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01897 Published 2021-02-05 No fix listed CWE-610

TI-2018-01789 CVE-2018-2401 · GHSA-689x-4mp2-jffr

XML external entity injection in SAP Business Process Automation By Redwood

MEDIUM 41

SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01587 Published 2018-03-14 No fix listed CWE-611

TI-2018-01788 CVE-2018-2400 · GHSA-gg5g-p469-j5vr

Under certain conditions SAP Business Process Automation (BPA) By Redwood, 9.00, 9.10…

LOW 36

Under certain conditions SAP Business Process Automation (BPA) By Redwood, 9.00, 9.10, allows an attacker to access information which would otherwise be restricted.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01614 Published 2018-03-14 No fix listed

TI-2018-01754 CVE-2018-2366 · GHSA-mg6c-9wrm-f57p

Path traversal in SAP Business Process Automation By Redwood

LOW 23

SAP Business Process Automation (BPA) By Redwood, 9.0, 9.1, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are pas…

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01512 Published 2018-03-14 No fix listed CWE-22