STER vulnerabilities

Vulnerability in STER prior to version 9.5. The application uses unencrypted TCP traffic to transmit data, enabling Man-In-The-Middle attacks and interception of sensitive data such as passwords or authentication tokens.

STER software uses a weak password encoding algorithm, allowing the password value to be guessed after analyzing how known passwords are encoded. The issue was fixed in version 9.5.

SQL injection vulnerability in STER allows an authenticated attacker to inject SQL via search filters, potentially reading sensitive data of other users or other application data.