Cybelesoft Thinfinity Virtualui
6 CVEs affecting Cybelesoft Thinfinity Virtualui. Latest disclosed: 2022-02-09. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45092 | Critical | 9.8 | 2021-12-16 | Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter. |
CVE-2021-46354 | High | 7.5 | 2022-02-09 | Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cm… |
CVE-2019-16384 | Medium | 6.5 | 2020-06-04 | Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration. This enables files outside of the web directory to be re… |
CVE-2019-16385 | Medium | 6.1 | 2020-06-04 | Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?m… |
CVE-2021-44554 | Medium | 5.3 | 2021-12-20 | Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the ve… |
CVE-2021-44848 | Medium | 5.3 | 2021-12-13 | In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username ex… |