Journyx (jtime) vulnerabilities

2 known vulnerabilities in Journyx (jtime) from Journyx. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Journyx (jtime): Improper Restriction of XML External Entity Reference

  CVE-2024-6893Aug 8, 2024JournyxEPSS 32.9%

  The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.

• 8.8 High severity

  Journyx (jtime): Use of Hard-coded Credentials

  CVE-2024-6890Aug 7, 2024Journyx

  Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.