Vendor
MyComplianceOffice
8 known vulnerabilities.
Products
7 results · Clear filters · Feed
-
Medium 5.3
Arbitrary File Upload in MCO
MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An authorized, low-privileged attacker can upload files with arbitrary types to the server. Because vendor …
-
Medium 6.9
User Enumeration in MCO
MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during username reminder and password reset operations. An attacker can leverage these differen…
-
Medium 4.8
Stored Cross‑Site Scripting in MCO
MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to change the application logo can upload a crafted SVG file containing malicious JavaScript code that is executed when the logo…
-
Medium 5.1
Path Disclosure and Path Traversal in MCO
MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrary locations as well as indirect disclosure of absolute serv…
-
Medium 5.3
Unauthorized Access to Administrator ACL View in MCO
MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated, low-privileged user can retrieve administrator access control structures without proper authorizatio…
-
Medium 6.3
Account Denial of Service in MCO
MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, password resets are n…
-
Medium 5.3
Insecure Direct Object Reference in MCO
MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint. The application does not properly validate whether an authenticated user is authorized to access a r…