Resort Data Processing Inc. - vulnerabilities (CVEs)

5 CVEs in 1 products, 0 in the last 30 days, newest from 2023-09-07.

Products

CVE-2023-39421 - CVSS 7.7 (high), 2023-09-07: The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and…
CVE-2023-39424 - CVSS 9.9 (critical), 2023-09-07: A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content (such as a web…
CVE-2023-39420 - CVSS 9.9 (critical), 2023-09-07: The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a…
CVE-2023-39423 - CVSS 9.1 (critical), 2023-09-07: The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can…
CVE-2023-39422 - CVSS 9.8 (critical), 2023-09-07: The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a…