Talassoft Industrial Management Software
Monthly
Sensitive data disclosure in TMT Machine Industry and Trade's Talassoft Industrial Management Software (versions V.4 through pre-V.16) stems from hard-coded credentials embedded in the application, allowing remote attackers to retrieve protected sensitive data without authentication. The flaw was reported by Turkey's national CERT (TR-CERT/USOM) and carries a CVSS 9.1 rating. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting in Talassoft Industrial Management Software (TMT Machinery Industry and Trade Co. Ltd.) before V16.0.1 allows an authenticated user with the ability to write into a persisted field to plant un-neutralized JavaScript that executes in the browser session of any other user who later loads the affected page. Exploitation is not self-triggering and is not remote-unauthenticated: the attacker must already hold valid credentials with sufficient write privilege (PR:L) and must wait for a separate victim to view the injected content (UI:R), which confines impact to limited confidentiality and integrity loss within the victim's browser context (C:L/I:L, no availability impact) and yields a moderate CVSS 3.1 base score of 5.4. There is no public exploit identified at time of analysis, and no KEV or EPSS signal was supplied with the source data; the issue is reported by TR-CERT and affects all releases prior to V16.0.1.
Sensitive data disclosure in TMT Machine Industry and Trade's Talassoft Industrial Management Software (versions V.4 through pre-V.16) stems from hard-coded credentials embedded in the application, allowing remote attackers to retrieve protected sensitive data without authentication. The flaw was reported by Turkey's national CERT (TR-CERT/USOM) and carries a CVSS 9.1 rating. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting in Talassoft Industrial Management Software (TMT Machinery Industry and Trade Co. Ltd.) before V16.0.1 allows an authenticated user with the ability to write into a persisted field to plant un-neutralized JavaScript that executes in the browser session of any other user who later loads the affected page. Exploitation is not self-triggering and is not remote-unauthenticated: the attacker must already hold valid credentials with sufficient write privilege (PR:L) and must wait for a separate victim to view the injected content (UI:R), which confines impact to limited confidentiality and integrity loss within the victim's browser context (C:L/I:L, no availability impact) and yields a moderate CVSS 3.1 base score of 5.4. There is no public exploit identified at time of analysis, and no KEV or EPSS signal was supplied with the source data; the issue is reported by TR-CERT and affects all releases prior to V16.0.1.