Read the docs

Cleo

Records7All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Cleo records in CISA KEV
TI-2024-36997 Cleo Multiple Products Unauthenticated File Upload Vulnerability Priority CRITICAL 100KEV 2024-12-17TI-2024-34043 Cleo Multiple Products Unrestricted File Upload Vulnerability Priority CRITICAL 100KEV 2024-12-13

Components

Products in the NVD configurations · select one to filter the records
Lexicom 4 records CRITICAL Harmony 2 records CRITICAL Vltrader 2 records CRITICAL

Records

7 records

TI-2024-36997 CVE-2024-55956 · GHSA-v87c-pw6c-99w6

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24…

Priority CRITICAL 100KEV

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default se…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.93968 Published 2024-12-13 No fix listed CWE-77
TI-2022-20946 CVE-2022-42966 · GHSA-2p9h-ccw7-33gf

Exponential ReDoS in cleo leads to denial of service

Priority HIGH 66

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01165 Published 2022-11-09 Fixed in 1.0.0, 2.0.0 CWE-1333
Open these records in search →