Vendor: ivanti
In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unauthorized users.
Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.
Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.
Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation.
A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.