OpenAsset Digital Asset Management vulnerabilities
5 known CVE vulnerabilities in OpenAsset Digital Asset Management, translated and rated.
- CVE-2020-28860High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user input, incorporating it into SQL queries, allowing authenticated blind SQL injection.
- CVE-2020-28859Medium
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user-supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting (XSS) attacks.
- CVE-2020-28858High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly verify whether a request to the application was intentionally made by the user, allowing cross-site request forgery (CSRF) attacks on all user functions.
- CVE-2020-28857Medium
OpenAsset Digital Asset Management (DAM) through version 12.0.19 fails to properly sanitize user-supplied input in multiple parameters and endpoints, allowing stored cross-site scripting (XSS) attacks.
- CVE-2020-28856High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not correctly determine the originating IP address of HTTP requests, allowing attackers to spoof it using the X-Forwarded-For header, e.g., by supplying localhost address 127.0.0.1, effectively bypassing all IP-based access controls.