Quality Management
Monthly
Path traversal in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to escape the intended export directory by supplying crafted directory traversal sequences in the `file_name` argument of the `QuestionnaireService.runDataExportNow` function, enabling unauthorized file read and write operations on the server. A public proof-of-concept exploit is available via Google Drive, lowering the barrier to exploitation. The vendor did not respond to the researcher's disclosure, and no patch has been released.
Mass assignment (CWE-915) in Eleveo Quality Management 9.7.0 allows low-privileged authenticated attackers to inject arbitrary values into the `createdBy` attribute of conversation event records via the REST API endpoint `/enc-fwk-data/api/v3/conversations/<ID>/events`. By supplying unsanitized user-controlled input that the Conversation Handler binds directly to internal object attributes, an attacker can forge or alter audit trail metadata - misattributing quality management events to other users or obscuring their own activity. A public proof-of-concept exploit has been disclosed on Google Drive; the vendor did not respond to coordinated disclosure and no patch has been released.
Denial of service in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to crash or degrade the Conversation Handler component by supplying a malformed or oversized 'labels' argument to the /enc-fwk-data/api/v3/conversations/<ID>/events API endpoint. The vendor did not respond to pre-disclosure contact, meaning no official patch exists at time of analysis. A public proof-of-concept exploit has been released, raising the practical risk for organizations running this version in contact-center environments.
Cross-site scripting in Eleveo Quality Management 9.7.0 allows authenticated low-privileged users to inject malicious scripts into the Conversation Review component, which then execute in the browsers of other users who subsequently view the affected content. A public proof-of-concept exploit has been disclosed via Google Drive, and the vendor did not respond to responsible disclosure outreach, leaving no vendor-issued patch available at time of analysis. No active exploitation has been confirmed by CISA KEV.
An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database queries that can read individual fields. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Path traversal in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to escape the intended export directory by supplying crafted directory traversal sequences in the `file_name` argument of the `QuestionnaireService.runDataExportNow` function, enabling unauthorized file read and write operations on the server. A public proof-of-concept exploit is available via Google Drive, lowering the barrier to exploitation. The vendor did not respond to the researcher's disclosure, and no patch has been released.
Mass assignment (CWE-915) in Eleveo Quality Management 9.7.0 allows low-privileged authenticated attackers to inject arbitrary values into the `createdBy` attribute of conversation event records via the REST API endpoint `/enc-fwk-data/api/v3/conversations/<ID>/events`. By supplying unsanitized user-controlled input that the Conversation Handler binds directly to internal object attributes, an attacker can forge or alter audit trail metadata - misattributing quality management events to other users or obscuring their own activity. A public proof-of-concept exploit has been disclosed on Google Drive; the vendor did not respond to coordinated disclosure and no patch has been released.
Denial of service in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to crash or degrade the Conversation Handler component by supplying a malformed or oversized 'labels' argument to the /enc-fwk-data/api/v3/conversations/<ID>/events API endpoint. The vendor did not respond to pre-disclosure contact, meaning no official patch exists at time of analysis. A public proof-of-concept exploit has been released, raising the practical risk for organizations running this version in contact-center environments.
Cross-site scripting in Eleveo Quality Management 9.7.0 allows authenticated low-privileged users to inject malicious scripts into the Conversation Review component, which then execute in the browsers of other users who subsequently view the affected content. A public proof-of-concept exploit has been disclosed via Google Drive, and the vendor did not respond to responsible disclosure outreach, leaving no vendor-issued patch available at time of analysis. No active exploitation has been confirmed by CISA KEV.
An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database queries that can read individual fields. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.