Eleveo Quality Management vulnerabilities

A security flaw has been discovered in Eleveo Quality Management 9.7.0. The issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService of the component GWT RPC Handler. Manipulation results in information disclosure. The attack can be carried out remotely. The exploit has been publicly released and may be used. The vendor was contacted but did not respond.

A vulnerability was found in Eleveo Quality Management 9.7.0. It affects some unknown functionality of the file /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted but did not respond.

A vulnerability has been found in Eleveo Quality Management 9.7.0. It affects an unknown functionality of the file Scorecard.jsp of the component Questionnaire Audio Upload. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted but did not respond.

A path traversal vulnerability was identified in Eleveo Quality Management 9.7.0 in the function QuestionnaireService.runDataExportNow of the Questionnaire Service component. Manipulation of the file_name argument leads to path traversal. The attack can be performed remotely. The exploit is publicly available, and the vendor did not respond.

A vulnerability was determined in Eleveo Quality Management 9.7.0 in the Conversation Handler component, specifically in the file /enc-fwk-data/api/v3/conversations/<ID>/events. Manipulation of the createdBy argument causes dynamically-determined object attributes. The attack can be performed remotely. The exploit is public, and the vendor did not respond.

A vulnerability was found in Eleveo Quality Management 9.7.0 in the Conversation Handler component, specifically in the file /enc-fwk-data/api/v3/conversations/<ID>/events. Manipulation of the labels argument results in denial of service. The attack can be executed remotely. The exploit is public, and the vendor did not respond.

A vulnerability in Eleveo Quality Management 9.7.0 affects unknown code of the Conversation Review component. Manipulation leads to cross site scripting (XSS). Remote exploitation is possible, and the exploit has been publicly disclosed.