prolion records
9 published records for vendor prolion.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-287 Improper Authentication2
- CWE-798 Use of Hard-coded Credentials2
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-863 Incorrect Authorization1
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')1
- CWE-532 Insertion of Sensitive Information into Log File1
The weakness classes this vendor ships most often: where to look.
CWEAll records
9 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2023-36655No exploit | The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user tprolion · cryptospike · CWE-287 | Critical9.8 | — | 0.9% | Dec 6, 2023 |
36Monitor | CVE-2023-36649No exploit | Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to improlion · cryptospike · CWE-532 | Critical9.1 | — | 0.8% | Dec 11, 2023 |
35Monitor | CVE-2023-36646No exploit | Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges to prolion · cryptospike · CWE-863 | High8.8 | — | 0.8% | Dec 11, 2023 |
32Monitor | CVE-2023-36648No exploit | Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potprolion · cryptospike · CWE-287 | High8.2 | — | 0.9% | Dec 11, 2023 |
30Monitor | CVE-2023-36647No exploit | A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impprolion · cryptospike · CWE-798 | High7.5 | — | 0.7% | Dec 11, 2023 |
28Monitor | CVE-2023-36651No exploit | Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consuprolion · cryptospike · CWE-798 | High7.2 | — | 0.9% | Dec 11, 2023 |
28Monitor | CVE-2023-36650No exploit | A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux useprolion · cryptospike · CWE-354 | High7.2 | — | 0.3% | Dec 11, 2023 |
26Monitor | CVE-2023-36654No exploit | Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to download prolion · cryptospike · CWE-22 | Medium6.5 | — | 1.2% | Dec 11, 2023 |
17Monitor | CVE-2023-36652No exploit | A SQL Injection in the users searching REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to read databprolion · cryptospike · CWE-89 | Medium4.3 | — | 0.5% | Dec 11, 2023 |
- CVE-2023-3665539Monitor
The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user t
CriticalCVSS 9.8No exploitEPSS 0%prolion · cryptospikeDec 6, 2023
- CVE-2023-3664936Monitor
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to im
CriticalCVSS 9.1No exploitEPSS 0%prolion · cryptospikeDec 11, 2023
- CVE-2023-3664635Monitor
Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges to
HighCVSS 8.8No exploitEPSS 0%prolion · cryptospikeDec 11, 2023
- CVE-2023-3664832Monitor
Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read pot
HighCVSS 8.2No exploitEPSS 0%prolion · cryptospikeDec 11, 2023
- CVE-2023-3664730Monitor
A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to imp
HighCVSS 7.5No exploitEPSS 0%prolion · cryptospikeDec 11, 2023
- CVE-2023-3665128Monitor
Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consu
HighCVSS 7.2No exploitEPSS 0%prolion · cryptospikeDec 11, 2023
- CVE-2023-3665028Monitor
A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux use
HighCVSS 7.2No exploitEPSS 0%prolion · cryptospikeDec 11, 2023
- CVE-2023-3665426Monitor
Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to download
MediumCVSS 6.5No exploitEPSS 1%prolion · cryptospikeDec 11, 2023
- CVE-2023-3665217Monitor
A SQL Injection in the users searching REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to read datab
MediumCVSS 4.3No exploitEPSS 0%prolion · cryptospikeDec 11, 2023