Agentis
Monthly
Account enumeration in Rolantis Agentis before 4.8 lets remote unauthenticated attackers infer whether accounts exist by observing differing responses from account-handling functionality. The flaw is a CWE-204 observable response discrepancy with low confidentiality impact and no integrity or availability impact, and it is fully remediated by upgrading to 4.8. No public exploit identified at time of analysis.
Agentis versions 4.44 up to (but not including) 4.6 are vulnerable to a reflected cross-site scripting (XSS) flaw (CWE-79) that allows an attacker to inject script into HTML attribute contexts within generated web pages. Exploitation requires a victim to load attacker-controlled input, typically via a crafted link, and no authentication is required for the attacker; the impact is limited to the victim's browser session with low confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and the vendor CVSS 3.1 base score is 6.1.
Account enumeration in Rolantis Agentis before 4.8 lets remote unauthenticated attackers infer whether accounts exist by observing differing responses from account-handling functionality. The flaw is a CWE-204 observable response discrepancy with low confidentiality impact and no integrity or availability impact, and it is fully remediated by upgrading to 4.8. No public exploit identified at time of analysis.
Agentis versions 4.44 up to (but not including) 4.6 are vulnerable to a reflected cross-site scripting (XSS) flaw (CWE-79) that allows an attacker to inject script into HTML attribute contexts within generated web pages. Exploitation requires a victim to load attacker-controlled input, typically via a crafted link, and no authentication is required for the attacker; the impact is limited to the victim's browser session with low confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and the vendor CVSS 3.1 base score is 6.1.