Data Systems Consulting vulnerabilities
We track 2 vulnerabilities in Data Systems Consulting products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 20, 2022.
2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score
Latest Data Systems Consulting vulnerabilities
- 7.5 High severity
BPM: Improper Restriction of XML External Entity Reference
Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.
- 9.8 Critical severity
BPM: Improper Neutralization of Special Elements used in an SQL Command
Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.