Skip to content
Noroxi

Cleo records

4 published records for vendor Cleo. 2 of them have been exploited in the wild (listed in CISA KEV) and 2 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
2 · 50%
Weaponized
2 · 50%
Pre-auth RCE
2
With a fix record
0%
Median publish → KEV
25 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 21
  2. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

4 records
  • CVE-2024-50623
    99Now

    In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download th

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    cleo · harmonyOct 28, 2024

  • CVE-2024-55956
    97Now

    In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbit

    CriticalCVSS 9.8KEVWeaponizedEPSS 93%

    cleo · harmonyDec 13, 2024

  • CVE-2021-33576
    39Monitor

    An issue was discovered in Cleo LexiCom 5.5.0.0.

    CriticalCVSS 9.8No exploitEPSS 1%

    cleo · lexicomJun 18, 2021

  • CVE-2021-33577
    21Monitor

    An issue was discovered in Cleo LexiCom 5.5.0.0.

    MediumCVSS 5.3No exploitEPSS 0%

    cleo · lexicomJun 18, 2021