Known vulnerabilities in OnBase

Vendor: Hyland Software
Software: OnBase
Software CPE: cpe:2.3:a:hyland_software:onbase:*:*:*:*:*:*:*:*
Website: https://www.hyland.com/en/
Total vulnerabilities: 14
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting OnBase OnBase is affected by 14 known vulnerabilities: 6 high, 7 medium, 1 low Critical High Medium Low

Vulnerabilities (14)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU46700 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2020-25248		 CWE-22 Medium
No
No
 - 14.09.2020 SB2020091425
#VU46696 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2020-25247		 CWE-22 Medium
No
No
 - 14.09.2020 SB2020091425
#VU46694 - Deserialization of Untrusted Data
CVE-2020-25260		 CWE-502 Medium
No
No
 - 14.09.2020 SB2020091425
#VU46704 - Improper Authorization
CVE-2020-25251		 CWE-285 High
No
No
 - 11.09.2020 SB2020091425
#VU46705 - Insufficient Logging
CVE-2020-25250		 CWE-778 Medium
No
No
 - 11.09.2020 SB2020091425
#VU46706 - Deserialization of Untrusted Data
CVE-2020-25259		 CWE-502 High
No
No
 - 11.09.2020 SB2020091425
#VU46707 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2020-25257		 CWE-611 Medium
No
No
 - 11.09.2020 SB2020091425
#VU46708 - Cross-Site Request Forgery (CSRF)
CVE-2020-25252		 CWE-352 Low
No
No
 - 11.09.2020 SB2020091425
#VU46709 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-25253		 CWE-89 High
No
No
 - 11.09.2020 SB2020091425
#VU46711 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-25254		 CWE-89 High
No
No
 - 11.09.2020 SB2020091425
#VU46712 - Use of Hard-coded Cryptographic Key
CVE-2020-25256		 CWE-321 High
No
No
 - 11.09.2020 SB2020091425
#VU46713 - Deserialization of Untrusted Data
CVE-2020-25258		 CWE-502 High
No
No
 - 11.09.2020 SB2020091425
#VU46715 - Improper Output Neutralization for Logs
CVE-2020-25255		 CWE-117 Medium
No
No
 - 11.09.2020 SB2020091425
#VU46716 - Insufficient Logging
CVE-2020-25249		 CWE-778 Medium
No
No
 - 11.09.2020 SB2020091425