Sideman

**Name of the Vulnerable Software and Affected Versions** Agentflow (affected versions not specified) **Description** Agentflow, developed by Flowring, exhibits an Arbitrary File Upload issue. Authenticated remote attackers can exploit this to upload and execute web shell backdoors, potentially leading to arbitrary code execution on the server. The issue allows attackers to gain control of the system by uploading malicious files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Agentflow versions (affected versions not specified) **Description** Agentflow, developed by Flowring, exhibits an authentication bypass condition. Unauthenticated remote attackers can exploit a specific functionality to obtain arbitrary user authentication tokens and gain access to the system as any user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Agentflow versions (affected versions not specified) Windows Admin Center versions (affected versions not specified) **Description** Agentflow, developed by Flowring, exhibits a Missing Authentication issue. This allows unauthenticated remote attackers to perform actions on the database, including reading, modifying, and deleting its contents, through a specific functionality. A separate high-severity flaw exists in the Azure SSO implementation of Windows Admin Center, potentially allowing a local administrator on a single machine to achieve tenant-wide remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ragic Enterprise Cloud Database (affected versions not specified) **Description** An unauthenticated remote attacker can exploit a Relative Path Traversal issue to download arbitrary system files. The issue is an Arbitrary File Read impacting the Enterprise Cloud Database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ragic Enterprise Cloud Database (affected versions not specified) **Description** The Ragic Enterprise Cloud Database contains a hard-coded cryptographic key issue. This allows unauthenticated remote attackers to exploit the fixed key to generate verification information and log into the system as any user. The issue enables attackers to bypass authentication completely and impersonate any user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: OMFLOW from The SYSCOM Group (affected versions not specified) Description: The issue is related to the download functionality in OMFLOW, which does not properly validate user input. This allows remote attackers with regular privileges to read arbitrary system files. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: OMFLOW from The SYSCOM Group (affected versions not specified) Description: The issue is related to the data query functionality in OMFLOW, which does not properly restrict the query range. This allows remote attackers with regular privileges to obtain accounts and password hashes of other users. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: OMFLOW from The SYSCOM Group (affected versions not specified) Description: The issue allows remote attackers with regular privileges to update system settings or create accounts with administrator privileges, thereby gaining control of the server. This is due to the system not properly restricting access to the system settings modification functionality. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: OMFLOW from The SYSCOM Group (affected versions not specified) Description: The issue allows unauthorized remote attackers to read arbitrary system configurations. If LDAP authentication is enabled, attackers can obtain plaintext credentials. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.