Avesi S
Monthly
An open redirect (CWE-601) in Abis Technology Ltd. Co.'s AVESİS platform allows remote attackers with no credentials to craft a link whose redirect parameter points to an arbitrary attacker-controlled site, so a victim who is lured into clicking it lands on malicious content while the navigation appears to originate from the trusted AVESİS instance. The defect affects builds from 202608201331 up to, but not including, 202608240351. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the mandatory victim interaction (UI:R) makes it an effective phishing-enablement primitive rather than a path to direct data or system compromise; the vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), which matches the independent assessment.
Information disclosure in ABIS Technology's AVESİS software allows unauthenticated remote attackers to bypass ACLs and access restricted functionality via manipulated web parameters. Affected versions prior to build 202606251646. Exploitation likelihood is low (EPSS 0.2%), no active exploitation is known, and a vendor patch is available.
An open redirect (CWE-601) in Abis Technology Ltd. Co.'s AVESİS platform allows remote attackers with no credentials to craft a link whose redirect parameter points to an arbitrary attacker-controlled site, so a victim who is lured into clicking it lands on malicious content while the navigation appears to originate from the trusted AVESİS instance. The defect affects builds from 202608201331 up to, but not including, 202608240351. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the mandatory victim interaction (UI:R) makes it an effective phishing-enablement primitive rather than a path to direct data or system compromise; the vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), which matches the independent assessment.
Information disclosure in ABIS Technology's AVESİS software allows unauthenticated remote attackers to bypass ACLs and access restricted functionality via manipulated web parameters. Affected versions prior to build 202606251646. Exploitation likelihood is low (EPSS 0.2%), no active exploitation is known, and a vendor patch is available.