Agorum core open vulnerabilities

A reflected cross-site scripting (XSS) vulnerability was discovered in Agorum core open versions 11.9.2 and 11.10.1. An attacker can inject a malicious script into a request, which will be executed in the victim's browser.

An SSRF vulnerability in the TunnelServlet component of Agorum core open v11.9.2 and v11.10.1 allows attackers to forcefully initiate connections to arbitrary internal and external resources via a crafted request. This can lead to sensitive data exposure.

An incorrect access control vulnerability in the dynawebservice component of Agorum core open versions 11.9.2 and 11.10.1 allows unauthenticated attackers to access arbitrary files on the system.

Incorrect access control in Agorum core open versions 11.9.2 and 11.10.1 allows authenticated attackers to escalate privileges to Administrator.

Software GmbH Agorum core open versions 11.9.2 and 11.10.1 were found to store credentials in plaintext.

An XML External Entity (XXE) vulnerability was discovered in Agorum core open versions 11.9.2 and 11.10.1 in the RSSReader endpoint. It allows attackers to access sensitive data by providing a crafted XML input.