Simmeth Lieferantenmanager
6 CVEs affecting Simmeth Lieferantenmanager. Latest disclosed: 2022-12-25. Critical: 2, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-44015 | Critical | 9.8 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to… |
CVE-2022-44013 | Critical | 9.1 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authentication because the password in a Crede… |
CVE-2022-44017 | High | 7.5 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victim's account after t… |
CVE-2022-44016 | High | 7.5 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LM_A… |
CVE-2022-44014 | Medium | 6.5 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks… |
CVE-2022-44012 | Medium | 5.4 | 2022-12-25 | An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6. An attacker can exe… |