Resort Data Processing, Inc. Irm Next Generation
5 CVEs affecting Resort Data Processing, Inc. Irm Next Generation. Latest disclosed: 2023-09-07. Critical: 2, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-39424 | Critical | 9.9 | 2023-09-07 | A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content (such as a web… |
CVE-2023-39420 | Critical | 9.9 | 2023-09-07 | The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresp… |
CVE-2023-39423 | High | 8.6 | 2023-09-07 | The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can l… |
CVE-2023-39421 | High | 7.7 | 2023-09-07 | The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Von… |
CVE-2023-39422 | Medium | 6.5 | 2023-09-07 | The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a J… |