druva kayıtları
druva üreticisine ait 9 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 2 · %22,2
- Pre-auth RCE
- 0
- Düzeltme kaydı olan
- %0
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')2
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-276 Incorrect Default Permissions1
- CWE-426 Untrusted Search Path1
- CWE-502 Deserialization of Untrusted Data1
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
9 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
34İzleyin | CVE-2020-5752Silahlaştırılmış | Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system druva · insync client · CWE-22 | Yüksek7,8 | — | %8,6 | 21 May 2020 |
34İzleyin | CVE-2019-3999Silahlaştırılmış | Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacdruva · insync client · CWE-78 | Yüksek7,8 | — | %8,6 | 25 Şub 2020 |
32İzleyin | CVE-2021-36667İstismar yok | Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the ldruva · insync client · CWE-78 | Yüksek7,8 | — | %2,7 | 12 Tem 2022 |
31İzleyin | CVE-2019-4000İstismar yok | Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attackdruva · insync · CWE-94 | Yüksek7,8 | — | %0,7 | 25 Şub 2020 |
31İzleyin | CVE-2021-36668İstismar yok | URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron druva · insync client · CWE-74 | Yüksek7,8 | — | %0,6 | 12 Tem 2022 |
31İzleyin | CVE-2019-4001İstismar yok | Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code.druva · insync · CWE-20 | Yüksek7,8 | — | %0,6 | 24 Mar 2020 |
31İzleyin | CVE-2021-36665İstismar yok | An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local privileges via the inSyncUpgradeDaemon.druva · insync client · CWE-502 | Yüksek7,8 | — | %0,5 | 12 Tem 2022 |
31İzleyin | CVE-2021-36666İstismar yok | An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDecommission.druva · insync client · CWE-426 | Yüksek7,8 | — | %0,5 | 12 Tem 2022 |
31İzleyin | CVE-2020-5798İstismar yok | inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privilegedruva · insync · CWE-276 | Yüksek7,8 | — | %0,3 | 7 Ara 2020 |
- CVE-2020-575234İzleyin
Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system
YüksekCVSS 7,8SilahlaştırılmışEPSS %9druva · insync client21 May 2020
- CVE-2019-399934İzleyin
Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attac
YüksekCVSS 7,8SilahlaştırılmışEPSS %9druva · insync client25 Şub 2020
- CVE-2021-3666732İzleyin
Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the l
YüksekCVSS 7,8İstismar yokEPSS %3druva · insync client12 Tem 2022
- CVE-2019-400031İzleyin
Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attack
YüksekCVSS 7,8İstismar yokEPSS %1druva · insync25 Şub 2020
- CVE-2021-3666831İzleyin
URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron
YüksekCVSS 7,8İstismar yokEPSS %1druva · insync client12 Tem 2022
- CVE-2019-400131İzleyin
Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code.
YüksekCVSS 7,8İstismar yokEPSS %1druva · insync24 Mar 2020
- CVE-2021-3666531İzleyin
An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local privileges via the inSyncUpgradeDaemon.
YüksekCVSS 7,8İstismar yokEPSS %1druva · insync client12 Tem 2022
- CVE-2021-3666631İzleyin
An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDecommission.
YüksekCVSS 7,8İstismar yokEPSS %0druva · insync client12 Tem 2022
- CVE-2020-579831İzleyin
inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privilege
YüksekCVSS 7,8İstismar yokEPSS %0druva · insync7 Ara 2020