Dominique Righetto

An origin validation error in the middleware allows an attacker to bypass origin verification. This flaw enables the execution of cross-domain authenticated requests, which occur when a request is made from one domain to another while maintaining the user's authentication session.

The API is prone to XML external entity (XXE) injection because XML external entity support is enabled by default. XXE is a type of attack where an application processes XML input containing a reference to an external entity, potentially allowing an attacker to read arbitrary files or perform server-side request forgery.

Improper restriction of XML external entity reference in ILM Informatique jOpenDocument allows Data Serialization External Entities Blowup. This occurs when the application fails to properly restrict XML external entities, which are references to external files or resources within an XML document.

Incorrect permission assignment for a critical resource allows the replacement of binaries.

Plaintext storage of a password allows the retrieval of embedded sensitive data.

A Cross-Site Request Forgery (CSRF) issue exists in the resource-management feature. This allows an attacker to upload files on behalf of connected users and then access those files without authentication.

A stored Cross-Site Scripting (XSS) issue exists in the survey-import feature of the web application. This allows an attacker to inject arbitrary JavaScript code that will execute within the browsing context of visitors accessing a compromised survey.

A flaw exists in the survey-import feature that allows an attacker to force the server to make HTTP GET requests to an arbitrary destination through crafted import requests. This is a Blind Server-Side Request Forgery (SSRF) issue.

The issue allows a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. Attacks can result in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data.

An issue was discovered that permits a bypass of the protection in place, allowing access to the data stored in the embedded database file.

An issue in Apiris Kafeo permits DLL hijacking, allowing a user to trigger the execution of arbitrary code every time the product is executed.

The issue allows DLL hijacking, enabling a user to trigger the execution of arbitrary code every time the product is executed.

An issue was discovered in Regify Regipay Client for Windows that allows DLL hijacking, enabling a user to trigger the execution of arbitrary code every time the product is executed. This issue can lead to the execution of malicious code, potentially compromising the system.

The issue allows stored Cross-site Scripting (XSS) attacks in several locations, enabling an attacker to store a JavaScript payload. This can lead to the execution of malicious scripts on the client-side.

An issue was discovered in the API, which is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. This occurs when processing a DOCX file containing a malicious DTD.

An issue was discovered in the API, which is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.

An issue was discovered in the API, which is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. This allows for potential exploitation.

The issue is related to a service exposed by the application that accepts a user-controlled parameter used to create an SQL query, making it prone to SQL injection. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

An issue was discovered in the application where a service exposed allows a basic user to access the profile information of all connected users.

An issue was discovered in the application where a service allows a basic user to cancel or delete a booking created by someone else, even if the basic user is not a member of the booking.