Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2022-32458

Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection

Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Digiwin
Products
Business Process Management
CVE-2022-32457

Data Systems Consulting Co., Ltd. BPM - Blind Server-Side Request Forgery (SSRF)

Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Business Process Management
CVE-2022-32456

Data Systems Consulting Co., Ltd. BPM - SQL Injection

Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Digiwin
Products
Business Process Management