Skip to content
OpenAdvisories
Critical ICSA-20-308-03 3 CVEs

ARC Informatique PcVue (Update A)

Published Nov 3, 2020 · Updated Jan 5, 2021 · Revision 2

Vendor: ARC Informatique Product: PcVue

Summary

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, expose sensitive data, and prevent legitimate users from connecting to PcVue services.

Vulnerabilities 3

  • Critical 9.8
    CVE-2020-26867

    ARC Informatique PcVue Deserialization of Untrusted Data

    ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.

    ARC Informatique PcVue
  • High 7.5
    CVE-2020-26868

    ARC Informatique PcVue Access to Critical Private Variable via Public Method

    ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems …

    ARC Informatique PcVue
  • High 7.5
    CVE-2020-26869

    ARC Informatique PcVue Exposure of Sensitive Information to an Unauthorized Actor

    ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users. This issue also affects third-party systems based on the Web Services Toolkit.

    ARC Informatique PcVue

Revision history

  1. #2

    ICSA-20-308-03 ARC Informatique PcVue (Update A)

  2. #1

    ICSA-20-308-03 ARC Informatique PcVue

References