Newgen OmniDocs vulnerabilities

A vulnerability was found in Newgen OmniDocs up to version 12.0.00 in the file /omnidocs/WebApiRequestRedirection. Manipulation of the DocumentId argument leads to improper control of resource identifiers, enabling remote attack. The exploit is publicly available.

Newgen OmniDocs up to version 12.0.00 has a vulnerability in the file /omnidocs/GetWebApiConfiguration where manipulation of the connectionDetails argument leads to information disclosure. The attack is remote, with high complexity, and the exploit is publicly available.

An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive information and execute a full account takeover via a crafted API request.