On-prem Enterprise Server vulnerabilities
5 known vulnerabilities in On-prem Enterprise Server from Altium. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
Altium Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files from
- 8.8 High severity
Altium Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the c
- 9.8 Critical severity
Altium Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all installations, an unauthenticated network attacker who can reach the server can forge valid download sig
- 7.6 High severity
AES: Improper Neutralization of Input During Web Page Generation
HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content.
- 9.8 Critical severity
AES contains a SQL injection vulnerability due to an inactive configuration that prevents the…
AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configuration is not enabled, crafted input may be improperly handled, allowing attackers to inject and execute