Oscar Atienza

**Name of the Vulnerable Software and Affected Versions** Affected versions not specified **Description** This issue allows an attacker to access application areas without proper access controls. An attacker can access the path '/epsilonnet/License/About.aspx' to obtain information about the license and configuration, including installed modules. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DM Corporative CMS (affected versions not specified) **Description** A SQL injection issue has been found, allowing an attacker to retrieve, create, update, and delete databases. This is achieved through the `name` and `cod` parameters in the "/antbuspre.asp" API endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DM Corporative CMS (affected versions not specified) **Description** A SQL injection issue has been found, allowing an attacker to retrieve, create, update, and delete databases. This is achieved through the `name` parameter in the "/antcatalogue.asp" API endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DM Corporative CMS (affected versions not specified) **Description** A SQL injection issue has been found, allowing an attacker to retrieve, create, update, and delete databases. This is achieved through the `cod` parameter in the "/administer/node-selection/data.asp" API endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DM Corporative CMS (affected versions not specified) **Description** A SQL injection issue has been found, allowing an attacker to retrieve, create, update, and delete databases. This is achieved through the `codform` parameter in the "/modules/forms/collectform.asp" API endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DM Corporative CMS (affected versions not specified) **Description** An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area by setting the `option` parameter equal to 0, 1, or 2 in the "/administer/selectionnode/framesSelectionNetworks.asp" API endpoint. **Recommendations** As a temporary workaround, consider restricting access to the "/administer/selectionnode/framesSelectionNetworks.asp" API endpoint to minimize the risk of exploitation. Avoid using the `option` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DM Corporative CMS (affected versions not specified) **Description** An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area by setting the `option` parameter equal to 0, 1, or 2 in the "/administer/select node/data.asp" endpoint. The endpoint is accessed with parameters such as `mode`, `id1`, `id2`, `session`, `cod`, and `networks`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DM Corporative CMS (affected versions not specified) **Description** An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area by setting the `option` parameter equal to 0, 1, or 2 in the "/administer/selectionnode/selection.asp" API endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DM Corporative CMS (affected versions not specified) **Description** The issue allows an attacker to view the contents of webroot/file by navigating to a non-existent file, potentially exposing sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DM Corporative CMS (affected versions not specified) **Description** An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area by setting the `option` parameter equal to 0, 1, or 2 in the "/administer/selectionnode/framesSelection.asp" API endpoint. **Recommendations** As a temporary workaround, consider restricting access to the "/administer/selectionnode/framesSelection.asp" API endpoint to minimize the risk of exploitation. Avoid using the `option` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QSige (affected versions not specified) **Description** The issue is related to the omission of user-controlled key authorization in the IDMSistemas platform, affecting the QSige product. This allows an attacker to extract sensitive information from the API by making a request to the `/qsige.locator/quotePrevious/centers/X` endpoint, where `X` supports values such as `1`, `2`, `3`, etc. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.