Tangro Business Workflow
8 CVEs affecting Tangro Business Workflow. Latest disclosed: 2020-12-18. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26174 | High | 8.8 | 2020-12-18 | tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. Howe… |
CVE-2020-26175 | Medium | 6.5 | 2020-12-18 | In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change profile information of… |
CVE-2020-26178 | Medium | 5.3 | 2020-12-18 | In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authenticated. |
CVE-2020-26177 | Medium | 4.3 | 2020-12-18 | In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. Ho… |
CVE-2020-26176 | Medium | 4.3 | 2020-12-18 | An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /api/document/<DocumentID>/attachments API… |
CVE-2020-26171 | Medium | 4.3 | 2020-12-18 | In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users ca… |
CVE-2020-26172 | Medium | 4.2 | 2020-12-18 | Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The J… |
CVE-2020-26173 | Low | 3.1 | 2020-12-18 | An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by providing a valid docume… |