Auieo Candidats
9 CVEs affecting Auieo Candidats. Latest disclosed: 2022-11-03. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-42744 | Critical | 9.8 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not… |
CVE-2022-42751 | High | 8.8 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This… |
CVE-2022-42750 | High | 8.8 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validat… |
CVE-2020-9341 | High | 8.8 | 2020-02-22 | CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI. |
CVE-2022-25228 | Medium | 6.5 | 2022-08-18 | CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=… |
CVE-2022-42749 | Medium | 6.1 | 2022-11-03 | CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the… |
CVE-2022-42748 | Medium | 6.1 | 2022-11-03 | CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible bec… |
CVE-2022-42747 | Medium | 6.1 | 2022-11-03 | CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because th… |
CVE-2022-42746 | Medium | 6.1 | 2022-11-03 | CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because… |