Medium

DATE	CVE	VULNERABILITY TITLE	RISK
2022-02-04	CVE-2021-29394	Incorrect Authorization vulnerability in Globalnorthstar Northstar Club Management 6.3 Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST request. network low complexity globalnorthstar CWE-863	6.5
2022-02-04	CVE-2021-29398	Path Traversal vulnerability in Globalnorthstar Northstar Club Management 6.3 Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to browse and list the directories across the entire filesystem of the host of the web application. network low complexity globalnorthstar CWE-22	5.3