Supremo
Monthly
Improper TLS certificate validation in Nanosystems Supremo for Windows and macOS before 5.0.2.3874 lets an attacker positioned on the same LAN or Wi-Fi segment terminate and relay a Supremo client's TLS session using a self-signed certificate, exposing usernames, SHA-256 password hashes and license codes. The flaw is rated CVSS 7.6 (CVSS:4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N) and requires no authentication or user interaction, but exploitation is conditional on adjacent-network positioning and an active man-in-the-middle with correct timing rather than being reachable across the internet. No public exploit code has been identified at time of analysis, and the vendor-released fix is version 5.0.2.3874 or later.
Cross-Site Request Forgery (CSRF) vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horse with the Supremo.exe filename. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper TLS certificate validation in Nanosystems Supremo for Windows and macOS before 5.0.2.3874 lets an attacker positioned on the same LAN or Wi-Fi segment terminate and relay a Supremo client's TLS session using a self-signed certificate, exposing usernames, SHA-256 password hashes and license codes. The flaw is rated CVSS 7.6 (CVSS:4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N) and requires no authentication or user interaction, but exploitation is conditional on adjacent-network positioning and an active man-in-the-middle with correct timing rather than being reachable across the internet. No public exploit code has been identified at time of analysis, and the vendor-released fix is version 5.0.2.3874 or later.
Cross-Site Request Forgery (CSRF) vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horse with the Supremo.exe filename. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.