Heng-Chia Kuo

**Name of the Vulnerable Software and Affected Versions** EasyFlow .NET (affected versions not specified) **Description** Insecure Deserialization allows unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content. Deserialization is the process of converting a sequence of bytes back into an object. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EasyFlow .NET (affected versions not specified) **Description** An SQL Injection flaw allows authenticated remote attackers to inject arbitrary SQL commands, enabling them to read sensitive database contents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EasyFlow .NET (affected versions not specified) **Description** An arbitrary file read flaw allows authenticated remote attackers to download arbitrary system files from the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EasyFlow .NET (affected versions not specified) **Description** Missing authentication allows unauthenticated remote attackers to obtain the plaintext passwords of other users through a specific API endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EasyFlow .NET (affected versions not specified) **Description** Reflected Cross-site Scripting occurs when an application includes untrusted data in a web page without proper validation or encoding. Unauthenticated remote attackers can execute arbitrary JavaScript codes in a user's browser through phishing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.