MITRE records

15 published records for vendor mitre.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 6.7%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

15 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
41Plan	CVE-2021-42561Proof of concept	An issue was discovered in CALDERA 2.8.1.mitre · caldera · CWE-74 RCE	High8.8	—	19.6%	Jan 12, 2022
41Plan	CVE-2008-4704Proof of concept	PHP remote file inclusion vulnerability in SezHooTabsAndActions.php in SezHoo 0.1 allows remote attackers to execute arbitrary PHP code via mitre · sezhoo · CWE-94 pre-auth RCE	Critical10.0	—	3.5%	Oct 23, 2008
36Monitor	CVE-2020-19907No exploit	A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command omitre · caldera · CWE-78 RCE Command injection	High8.8	—	3.0%	Jul 12, 2021
36Monitor	CVE-2021-42560Proof of concept	An issue was discovered in CALDERA 2.9.0.mitre · caldera · CWE-611 XXE	High8.8	—	2.1%	Jan 12, 2022
36Monitor	CVE-2021-42559Proof of concept	An issue was discovered in CALDERA 2.8.1.mitre · caldera · CWE-77 RCE Command injection	High8.8	—	2.0%	Jan 12, 2022
32Monitor	CVE-2021-42562Proof of concept	An issue was discovered in CALDERA 2.8.1.mitre · caldera · CWE-269	High8.1	—	1.2%	Jan 12, 2022
30Monitor	CVE-2022-31004No exploit	Potential secrets being logged to disk in CVE Servicesmitre · cve-services · CWE-779 Pre-auth	High7.5	—	1.0%	Jun 2, 2022
28Monitor	CVE-2021-46561No exploit	controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organizamitre · cve services · CWE-863 Broken access control (IDOR)	High7.2	—	0.8%	Jan 26, 2022
24Monitor	CVE-2021-42558Proof of concept	An issue was discovered in CALDERA 2.8.1.mitre · caldera · CWE-79 Pre-auth XSS	Medium6.1	—	1.1%	Jan 12, 2022
24Monitor	CVE-2022-40606No exploit	MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability thmitre · caldera · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Oct 17, 2022
24Monitor	CVE-2022-40605No exploit	MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability thmitre · caldera · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Oct 17, 2022
21Monitor	CVE-2020-10807No exploit	auth_svc in Caldera before 2.6.5 allows authentication bypass (for REST API requests) via a forged "localhost" string in the HTTP Host heademitre · caldera · CWE-290 Pre-auth Auth bypass	Medium5.3	—	1.4%	Mar 22, 2020
21Monitor	CVE-2020-14462No exploit	CALDERA 2.7.0 allows XSS via the Operation Name box.mitre · caldera · CWE-79 XSS	Medium5.4	—	0.6%	Jun 19, 2020
21Monitor	CVE-2022-41139No exploit	MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary commitre · caldera · CWE-79 XSS	Medium5.4	—	0.6%	Oct 17, 2022
13Monitor	CVE-2023-51792No exploit	Buffer Overflow vulnerability in libde265 v1.0.12 allows a local attacker to cause a denial of service via the allocation size exceeding theCWE-121 Memory safety	Low3.3	—	0.2%	Apr 19, 2024

CVE-2021-42561
41Plan
An issue was discovered in CALDERA 2.8.1.
HighCVSS 8.8Proof of conceptEPSS 20%
- RCE
mitre · calderaJan 12, 2022
CVE-2008-4704
41Plan
PHP remote file inclusion vulnerability in SezHooTabsAndActions.php in SezHoo 0.1 allows remote attackers to execute arbitrary PHP code via
CriticalCVSS 10.0Proof of conceptEPSS 4%
- pre-auth RCE
mitre · sezhooOct 23, 2008
CVE-2020-19907
36Monitor
A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command o
HighCVSS 8.8No exploitEPSS 3%
- RCE
- Command injection
mitre · calderaJul 12, 2021
CVE-2021-42560
36Monitor
An issue was discovered in CALDERA 2.9.0.
HighCVSS 8.8Proof of conceptEPSS 2%
- XXE
mitre · calderaJan 12, 2022
CVE-2021-42559
36Monitor
An issue was discovered in CALDERA 2.8.1.
HighCVSS 8.8Proof of conceptEPSS 2%
- RCE
- Command injection
mitre · calderaJan 12, 2022
CVE-2021-42562
32Monitor
An issue was discovered in CALDERA 2.8.1.
HighCVSS 8.1Proof of conceptEPSS 1%
mitre · calderaJan 12, 2022
CVE-2022-31004
30Monitor
Potential secrets being logged to disk in CVE Services
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
mitre · cve-servicesJun 2, 2022
CVE-2021-46561
28Monitor
controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organiza
HighCVSS 7.2No exploitEPSS 1%
- Broken access control (IDOR)
mitre · cve servicesJan 26, 2022
CVE-2021-42558
24Monitor
An issue was discovered in CALDERA 2.8.1.
MediumCVSS 6.1Proof of conceptEPSS 1%
- Pre-auth
- XSS
mitre · calderaJan 12, 2022
CVE-2022-40606
24Monitor
MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability th
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
mitre · calderaOct 17, 2022
CVE-2022-40605
24Monitor
MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability th
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
mitre · calderaOct 17, 2022
CVE-2020-10807
21Monitor
auth_svc in Caldera before 2.6.5 allows authentication bypass (for REST API requests) via a forged "localhost" string in the HTTP Host heade
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
- Auth bypass
mitre · calderaMar 22, 2020
CVE-2020-14462
21Monitor
CALDERA 2.7.0 allows XSS via the Operation Name box.
MediumCVSS 5.4No exploitEPSS 1%
- XSS
mitre · calderaJun 19, 2020
CVE-2022-41139
21Monitor
MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary com
MediumCVSS 5.4No exploitEPSS 1%
- XSS
mitre · calderaOct 17, 2022
CVE-2023-51792
13Monitor
Buffer Overflow vulnerability in libde265 v1.0.12 allows a local attacker to cause a denial of service via the allocation size exceeding the
LowCVSS 3.3No exploitEPSS 0%
- Memory safety
Apr 19, 2024