PatchTheCVEtangro vulnerabilities
Recent CVEs affecting tangro products. 8 tracked.
tangro has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2020-12-18. Highest priority: CVE-2020-26174 (score 53/100).
- CVE-2020-26178 MEDIUM 5.3 UPGRADE In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attac
- CVE-2020-26177 MEDIUM 4.3 UPGRADE In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus a
- CVE-2020-26176 MEDIUM 4.3 UPGRADE An issue was discovered in tangro Business Workflow before 1.18.1
- CVE-2020-26175 MEDIUM 6.5 UPGRADE In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/
- CVE-2020-26174 HIGH 8.8 UPGRADE tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uplo
- CVE-2020-26173 LOW 3.1 UPGRADE An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to dow
- CVE-2020-26172 MEDIUM 4.2 UPGRADE Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker t
- CVE-2020-26171 MEDIUM 4.3 UPGRADE In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/u
FAQ
How do I fix tangro vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is tangro being exploited right now?
None of the tracked tangro CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which tangro CVE should I patch first?
CVE-2020-26174 currently ranks highest (53/100): tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uplo.