jedox records
8 published records for vendor jedox.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-434 Unrestricted Upload of File with Dangerous Type1
- CWE-522 Insufficiently Protected Credentials1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
- CWE-863 Incorrect Authorization1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
8 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
46Plan | CVE-2022-47878Proof of concept | Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specifyjedox · jedox · CWE-434 | High8.8 | — | 35.7% | May 2, 2023 |
38Monitor | CVE-2022-47875Proof of concept | A Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to execute arbitrary codejedox · cloud · CWE-22 | High8.8 | — | 10.1% | May 2, 2023 |
37Monitor | CVE-2022-47876Proof of concept | The integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to execute arbitrary code via Groovy-scripts.jedox · jedox | High8.8 | — | 7.0% | May 2, 2023 |
32Monitor | CVE-2022-47874Proof of concept | Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of database connections vijedox · cloud · CWE-863 | Medium6.5 | — | 21.1% | May 2, 2023 |
32Monitor | CVE-2022-47879Proof of concept | A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classesjedox · jedox · CWE-94 | High7.5 | — | 6.2% | May 12, 2023 |
22Monitor | CVE-2022-47880Proof of concept | An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to mojedox · jedox · CWE-522 | Medium5.3 | — | 2.9% | May 12, 2023 |
22Monitor | CVE-2022-47877Proof of concept | A Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary web script or HTML in tjedox · jedox · CWE-79 | Medium5.4 | — | 2.6% | May 2, 2023 |
20Monitor | CVE-2007-3581No exploit | The Jedox Palo 1.5 client transmits the password in cleartext, which might allow remote attackers to obtain the password by sniffing the netjedox · palo | Medium5.0 | — | 1.5% | Jul 5, 2007 |
- CVE-2022-4787846Plan
Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specify
HighCVSS 8.8Proof of conceptEPSS 35%jedox · jedoxMay 2, 2023
- CVE-2022-4787538Monitor
A Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to execute arbitrary code
HighCVSS 8.8Proof of conceptEPSS 10%jedox · cloudMay 2, 2023
- CVE-2022-4787637Monitor
The integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to execute arbitrary code via Groovy-scripts.
HighCVSS 8.8Proof of conceptEPSS 7%jedox · jedoxMay 2, 2023
- CVE-2022-4787432Monitor
Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of database connections vi
MediumCVSS 6.5Proof of conceptEPSS 21%jedox · cloudMay 2, 2023
- CVE-2022-4787932Monitor
A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes
HighCVSS 7.5Proof of conceptEPSS 6%jedox · jedoxMay 12, 2023
- CVE-2022-4788022Monitor
An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to mo
MediumCVSS 5.3Proof of conceptEPSS 2%jedox · jedoxMay 12, 2023
- CVE-2022-4787722Monitor
A Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary web script or HTML in t
MediumCVSS 5.4Proof of conceptEPSS 2%jedox · jedoxMay 2, 2023
- CVE-2007-358120Monitor
The Jedox Palo 1.5 client transmits the password in cleartext, which might allow remote attackers to obtain the password by sniffing the net
MediumCVSS 5.0No exploitEPSS 1%jedox · paloJul 5, 2007