Claudemir Nunes

6 exploits Active since Sep 2020
CVE-2020-24028 NOMISEC HIGH WRITEUP
ForLogic Qualiex v1-v3 - Privilege Escalation
ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates. NOTE: as of 2025-10-14, the Supplier's perspective is that this "does not allow administrative privilege gain. Authorization is enforced server-side, restricting actions to the user’s own permission scope."
CVSS 8.8
CVE-2020-24028 NOMISEC HIGH WRITEUP
ForLogic Qualiex v1-v3 - Privilege Escalation
ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates. NOTE: as of 2025-10-14, the Supplier's perspective is that this "does not allow administrative privilege gain. Authorization is enforced server-side, restricting actions to the user’s own permission scope."
CVSS 8.8
CVE-2020-24029 NOMISEC CRITICAL WRITEUP
ForLogic Qualiex v1/v3 - Info Disclosure
Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "corrected in all maintained versions. Password reset requests are validated against registered user emails and require a valid, short-lived token."
CVSS 9.8
CVE-2020-24029 NOMISEC CRITICAL WRITEUP
ForLogic Qualiex v1/v3 - Info Disclosure
Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "corrected in all maintained versions. Password reset requests are validated against registered user emails and require a valid, short-lived token."
CVSS 9.8
CVE-2020-24030 NOMISEC CRITICAL WRITEUP
ForLogic Qualiex v1/v3 - Privilege Escalation
ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access to sensitive data via token reuse. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "not exploitable in the current implementation. Tokens are properly expired, invalidated, and bound to session context. Attempts to alter the token payload to extend its validity do not affect server-side validation."
CVSS 9.8
CVE-2020-24030 NOMISEC CRITICAL WRITEUP
ForLogic Qualiex v1/v3 - Privilege Escalation
ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access to sensitive data via token reuse. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "not exploitable in the current implementation. Tokens are properly expired, invalidated, and bound to session context. Attempts to alter the token payload to extend its validity do not affect server-side validation."
CVSS 9.8