Ba Workflow
Monthly
SQL injection in YS-infoware BA-Workflow allows authenticated remote attackers with low privileges to read, modify, and delete arbitrary database contents. The CPE wildcard indicates all product versions are affected, and exploitation requires only a valid low-privilege session with no user interaction. No public exploit code was identified at time of analysis.
SQL injection in YS-infoware BA-Workflow lets authenticated remote attackers execute arbitrary SQL statements, enabling them to read, modify, and delete database contents. The issue is rated CVSS 8.7 and affects BA-Workflow deployments matching the version-agnostic CPE supplied by TW-CERT; exploitation requires a valid BA-Workflow account, which limits exposure to users who can authenticate. No public exploit code was identified at time of analysis, and the product's limited deployment base makes this a credible but second-tier priority rather than a broadly urgent Internet-wide threat.
SQL injection in BA-Workflow (YS-infoware) allows authenticated remote attackers with low privileges to inject arbitrary SQL statements and read, modify, or delete database contents. The CVSS 4.0 score is 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), reflecting network reachability, low complexity, no attack requirements, low-privilege authentication, no user interaction, and high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
SQL injection in YS-infoware BA-Workflow allows authenticated remote attackers with low privileges to read, modify, and delete arbitrary database contents. The CPE wildcard indicates all product versions are affected, and exploitation requires only a valid low-privilege session with no user interaction. No public exploit code was identified at time of analysis.
SQL injection in YS-infoware BA-Workflow lets authenticated remote attackers execute arbitrary SQL statements, enabling them to read, modify, and delete database contents. The issue is rated CVSS 8.7 and affects BA-Workflow deployments matching the version-agnostic CPE supplied by TW-CERT; exploitation requires a valid BA-Workflow account, which limits exposure to users who can authenticate. No public exploit code was identified at time of analysis, and the product's limited deployment base makes this a credible but second-tier priority rather than a broadly urgent Internet-wide threat.
SQL injection in BA-Workflow (YS-infoware) allows authenticated remote attackers with low privileges to inject arbitrary SQL statements and read, modify, or delete database contents. The CVSS 4.0 score is 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), reflecting network reachability, low complexity, no attack requirements, low-privilege authentication, no user interaction, and high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.