Vendors / Cybelesoft Records 13 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 6
Exploited now Cybelesoft records in CISA KEV No Cybelesoft vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 70
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.40584 · Published 2021-12-16 · No fix listed
Priority MEDIUM 47
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.12888 · Published 2022-02-09 · No fix listed CWE-668
Priority MEDIUM 44
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.22966 · Published 2021-12-13 · No fix listed CWE-203
Priority LOW 31
Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01086 · Published 2020-06-04 · No fix listed CWE-22
Priority LOW 29
Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?mimetype= substring.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.008 · Published 2020-06-04 · No fix listed CWE-74
Priority LOW 26
Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01063 · Published 2021-12-20 · No fix listed CWE-203
Open these records in search → All records by CVSS severity
2 6 5 0 0
THREATIST.IORead the docs