Sign in Free assessment

sparkdevnetwork records

3 published records for vendor sparkdevnetwork.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

20
21

Bar: total · dark part: CISA KEV.

Recurring classes

CWE-434 Unrestricted Upload of File with Dangerous Type1

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

3 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2019-18643No exploit	Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application.sparkdevnetwork · rock rms · CWE-434 pre-auth RCE File upload	Critical9.8	—	4.1%	Jan 7, 2021
40Plan	CVE-2019-18641No exploit	Rock RMS before 1.8.6 mishandles vCard access control within the People/GetVCard/REST controller.sparkdevnetwork · rock rms Pre-auth	Critical9.8	—	3.4%	Mar 20, 2020
40Plan	CVE-2019-18642No exploit	Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile update feature.sparkdevnetwork · rock rms Pre-auth	Critical9.8	—	1.7%	Jan 7, 2021

CVE-2019-18643
40Plan
Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application.
CriticalCVSS 9.8No exploitEPSS 4%
- pre-auth RCE
- File upload
sparkdevnetwork · rock rmsJan 7, 2021
CVE-2019-18641
40Plan
Rock RMS before 1.8.6 mishandles vCard access control within the People/GetVCard/REST controller.
CriticalCVSS 9.8No exploitEPSS 3%
- Pre-auth
sparkdevnetwork · rock rmsMar 20, 2020
CVE-2019-18642
40Plan
Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile update feature.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
sparkdevnetwork · rock rmsJan 7, 2021