Cybelesoft
Cybelesoft Thinfinity Virtualui: vulnerabilidades y CVE
Cybelesoft Thinfinity Virtualui tiene 6 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE6
Últimos 12 meses0
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2021-46354 | Alta (7.5) | 13% | — | 9 feb 2022 | Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can… |
| CVE-2021-44554 | Media (5.3) | 1.0% | — | 20 dic 2021 | Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks… |
| CVE-2021-45092 | Crítica (9.8) | 41% | — | 16 dic 2021 | Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter. |
| CVE-2021-44848 | Media (5.3) | 23% | — | 13 dic 2021 | In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists. |
| CVE-2019-16385 | Media (6.1) | 0.80% | — | 4 jun 2020 | Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?mimetype= substring. The victim user must load an application… |
| CVE-2019-16384 | Media (6.5) | 1.1% | — | 4 jun 2020 | Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration. This enables files outside of the web directory to be retrieved if the exact location is known and the user has… |