Library Information And Document Automation Program
Monthly
Open redirect exploitation in Yordam Informatics Technology's Library Information and Document Automation Program enables unauthenticated network-based phishing attacks against end users. Versions from v22.1 up to (but not including) v22.2 fail to validate redirect target URLs, allowing attackers to craft legitimate-looking library system URLs that silently forward victims to attacker-controlled sites. The Scope:Changed designation in the CVSS vector confirms the impact crosses from the server component into the user's browser session, enabling credential harvesting or malware delivery under the trusted domain's brand. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated SSRF in Yordam Informatics' Library Information and Document Automation Program allows remote attackers to induce the server to issue arbitrary HTTP requests to internal or external destinations. Affecting all versions before v22.2, the flaw is reachable without credentials over the network, giving attackers a pivot point to probe internal network resources, cloud metadata endpoints, or other services inaccessible from the public internet. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program (all versions before v22.2) allows unauthenticated remote attackers to inject malicious scripts into HTML attribute contexts, executing arbitrary JavaScript in victims' browsers. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C vector confirms a classic reflected XSS pattern requiring only that a target user click a crafted link. Reported by TR-CERT with no public exploit or KEV listing at time of analysis.
Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program enables unauthenticated network attackers to inject malicious scripts into pages served to authenticated library staff or patrons. Affected versions span v22.1 up to (but not including) v22.2. No active exploitation has been identified and no public proof-of-concept is known, but the vulnerability is reported by TR-CERT and carries a scope-changing CVSS vector reflecting its potential to pivot from the web app context into the victim's browser session.
Open redirect exploitation in Yordam Informatics Technology's Library Information and Document Automation Program enables unauthenticated network-based phishing attacks against end users. Versions from v22.1 up to (but not including) v22.2 fail to validate redirect target URLs, allowing attackers to craft legitimate-looking library system URLs that silently forward victims to attacker-controlled sites. The Scope:Changed designation in the CVSS vector confirms the impact crosses from the server component into the user's browser session, enabling credential harvesting or malware delivery under the trusted domain's brand. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated SSRF in Yordam Informatics' Library Information and Document Automation Program allows remote attackers to induce the server to issue arbitrary HTTP requests to internal or external destinations. Affecting all versions before v22.2, the flaw is reachable without credentials over the network, giving attackers a pivot point to probe internal network resources, cloud metadata endpoints, or other services inaccessible from the public internet. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program (all versions before v22.2) allows unauthenticated remote attackers to inject malicious scripts into HTML attribute contexts, executing arbitrary JavaScript in victims' browsers. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C vector confirms a classic reflected XSS pattern requiring only that a target user click a crafted link. Reported by TR-CERT with no public exploit or KEV listing at time of analysis.
Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program enables unauthenticated network attackers to inject malicious scripts into pages served to authenticated library staff or patrons. Affected versions span v22.1 up to (but not including) v22.2. No active exploitation has been identified and no public proof-of-concept is known, but the vulnerability is reported by TR-CERT and carries a scope-changing CVSS vector reflecting its potential to pivot from the web app context into the victim's browser session.