Skip to content
Noroxi

cybelesoft records

13 published records for vendor cybelesoft.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
7.7%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 20
  3. 21
  4. 22
  5. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

13 records
  • CVE-2021-45092
    51Plan

    Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath paramete

    CriticalCVSS 9.8Proof of conceptEPSS 40%

    cybelesoft · thinfinity virtualuiDec 16, 2021

  • CVE-2024-40404
    39Monitor

    Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Socke

    CriticalCVSS 9.8No exploitEPSS 0%

    cybelesoft · thinfinity workspaceNov 13, 2024

  • CVE-2022-25227
    35Monitor

    Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if th

    HighCVSS 8.8No exploitEPSS 0%

    cybelesoft · thinfinity vncMay 20, 2022

  • CVE-2021-46354
    34Monitor

    Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the par

    HighCVSS 7.5Proof of conceptEPSS 12%

    cybelesoft · thinfinity virtualuiFeb 9, 2022

  • CVE-2024-40405
    32Monitor

    Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via

    HighCVSS 8.1No exploitEPSS 0%

    cybelesoft · thinfinity workspaceNov 13, 2024

  • CVE-2015-1429
    31Monitor

    Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers

    HighCVSS 7.5No exploitEPSS 1%

    cybelesoft · thinfinity remote desktop workstationOct 6, 2017

  • CVE-2024-40407
    30Monitor

    A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application

    HighCVSS 7.5No exploitEPSS 0%

    cybelesoft · thinfinity workspaceNov 13, 2024

  • CVE-2024-40408
    29Monitor

    Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section.

    HighCVSS 7.3No exploitEPSS 0%

    cybelesoft · thinfinity workspaceNov 13, 2024

  • CVE-2021-44848
    28Monitor

    In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whet

    MediumCVSS 5.3Proof of conceptEPSS 22%

    cybelesoft · thinfinity virtualuiDec 12, 2021

  • CVE-2019-16384
    26Monitor

    Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration.

    MediumCVSS 6.5No exploitEPSS 1%

    cybelesoft · thinfinity virtualuiJun 4, 2020

  • CVE-2019-16385
    24Monitor

    Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated

    MediumCVSS 6.1No exploitEPSS 0%

    cybelesoft · thinfinity virtualuiJun 4, 2020

  • CVE-2021-44554
    21Monitor

    Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI.

    MediumCVSS 5.3No exploitEPSS 1%

    cybelesoft · thinfinity virtualuiDec 20, 2021

  • CVE-2024-40410
    19Monitor

    Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption.

    MediumCVSS 4.8No exploitEPSS 0%

    cybelesoft · thinfinity workspaceNov 13, 2024