Vulnerabilities

TI-2023-18918 CVE-2023-37288 · GHSA-wrv4-vrjr-m5jr

SmartBPM.NET - Path Traversal

LOW 35

SmartBPM.NET component has a vulnerability of path traversal within its file download function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00936 Published 2023-07-10 No fix listed CWE-23

TI-2023-18917 CVE-2023-37287 · GHSA-6h6x-2w77-g8ff

MEDIUM 49

SmartBPM.NET has a vulnerability of using hard-coded authentication key.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00942 Published 2023-07-10 No fix listed CWE-798

TI-2023-18916 CVE-2023-37286 · GHSA-f7w3-5qrp-w366

MEDIUM 51

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01006 Published 2023-07-10 No fix listed CWE-798

TI-2022-01772 CVE-2022-1912 · GHSA-268j-8q64-9cqx

MEDIUM 41

The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00617 Published 2022-07-18 No fix listed CWE-352