tangro records
8 published records for vendor tangro.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-639 Authorization Bypass Through User-Controlled Key3
- CWE-294 Authentication Bypass by Capture-replay1
- CWE-306 Missing Authentication for Critical Function1
- CWE-434 Unrestricted Upload of File with Dangerous Type1
- CWE-669 Incorrect Resource Transfer Between Spheres1
- CWE-922 Insecure Storage of Sensitive Information1
The weakness classes this vendor ships most often: where to look.
CWEAll records
8 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
35Monitor | CVE-2020-26174No exploit | tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes containedtangro · business workflow · CWE-434 | High8.8 | — | 1.2% | Dec 18, 2020 |
26Monitor | CVE-2020-26175No exploit | In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change protangro · business workflow · CWE-639 | Medium6.5 | — | 0.6% | Dec 18, 2020 |
26Monitor | CVE-2020-26172No exploit | Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a sessitangro · business workflow · CWE-294 | Medium6.5 | — | 0.6% | Dec 18, 2020 |
21Monitor | CVE-2020-26178No exploit | In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authentictangro · business workflow · CWE-639 | Medium5.3 | — | 0.8% | Dec 18, 2020 |
17Monitor | CVE-2020-26176No exploit | An issue was discovered in tangro Business Workflow before 1.18.1.tangro · business workflow · CWE-922 | Medium4.3 | — | 0.7% | Dec 18, 2020 |
17Monitor | CVE-2020-26173No exploit | An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by provitangro · business workflow · CWE-306 | Medium4.3 | — | 0.7% | Dec 18, 2020 |
17Monitor | CVE-2020-26177No exploit | In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited btangro · business workflow · CWE-669 | Medium4.3 | — | 0.6% | Dec 18, 2020 |
17Monitor | CVE-2020-26171No exploit | In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated.tangro · business workflow · CWE-639 | Medium4.3 | — | 0.5% | Dec 18, 2020 |
- CVE-2020-2617435Monitor
tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained
HighCVSS 8.8No exploitEPSS 1%tangro · business workflowDec 18, 2020
- CVE-2020-2617526Monitor
In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change pro
MediumCVSS 6.5No exploitEPSS 0%tangro · business workflowDec 18, 2020
- CVE-2020-2617226Monitor
Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a sessi
MediumCVSS 6.5No exploitEPSS 0%tangro · business workflowDec 18, 2020
- CVE-2020-2617821Monitor
In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authentic
MediumCVSS 5.3No exploitEPSS 0%tangro · business workflowDec 18, 2020
- CVE-2020-2617617Monitor
An issue was discovered in tangro Business Workflow before 1.18.1.
MediumCVSS 4.3No exploitEPSS 0%tangro · business workflowDec 18, 2020
- CVE-2020-2617317Monitor
An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by provi
MediumCVSS 4.3No exploitEPSS 0%tangro · business workflowDec 18, 2020
- CVE-2020-2617717Monitor
In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited b
MediumCVSS 4.3No exploitEPSS 0%tangro · business workflowDec 18, 2020
- CVE-2020-2617117Monitor
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated.
MediumCVSS 4.3No exploitEPSS 0%tangro · business workflowDec 18, 2020