Extensis

Records10All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

Extensis records in CISA KEV

No Extensis vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Portfolio 5 records MEDIUM Mrsid 3 records MEDIUM Netpublish Server 1 record LOW Portfolio Netpublish 1 record LOW

Records

10 records

TI-2013-03446 CVE-2013-3944 · GHSA-f2wr-35r3-8hpq

Out-of-bounds write in IrfanView MrSID plugin

MEDIUM 56

Stack-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via an IMAGE tag.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.275 Published 2020-01-02 Fixed in 4.37 CWE-787

TI-2022-08151 CVE-2022-24254 · GHSA-4rmw-hhg4-fq9w

An unrestricted file upload vulnerability in the Backup/Restore Archive component of…

MEDIUM 43

An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.026 Published 2022-03-01 No fix listed CWE-434

TI-2022-08149 CVE-2022-24252 · GHSA-44v8-ph5w-8jrx

An unrestricted file upload vulnerability in the FileTransferServlet component of…

MEDIUM 43

An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02333 Published 2022-03-01 No fix listed CWE-434

TI-2022-08152 CVE-2022-24255 · GHSA-wg4x-xg9m-9x3f

Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows…

MEDIUM 41

Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01376 Published 2022-03-01 No fix listed CWE-798

TI-2022-08150 CVE-2022-24253 · GHSA-g22v-hqhx-3chc

Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file…

MEDIUM 41

Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the component AdminFileTransferServlet.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01304 Published 2022-03-01 No fix listed CWE-434

TI-2022-08148 CVE-2022-24251 · GHSA-86fw-cmmp-48pg

Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file…

MEDIUM 41

Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0134 Published 2022-03-01 No fix listed CWE-434

TI-2013-03448 CVE-2013-3946 · GHSA-ph62-xvw6-h88g

Out-of-bounds write in IrfanView MrSID plugin

LOW 39

Heap-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a levels header.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.02488 Published 2020-01-02 Fixed in 4.37 CWE-787

TI-2013-03447 CVE-2013-3945 · GHSA-j2q9-fp38-97q8

Improper input validation in IrfanView MrSID plugin

LOW 38

The MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a nband tag.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.02071 Published 2020-01-02 Fixed in 4.37 CWE-20

TI-2017-13216 CVE-2017-18006 · GHSA-7377-5g8x-pp8m

netpub/server.np in Extensis Portfolio NetPublish has XSS in the quickfind parameter, aka Open Bug Bounty ID OBB-290447.

LOW 28

netpub/server.np in Extensis Portfolio NetPublish has XSS in the quickfind parameter, aka Open Bug Bounty ID OBB-290447.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00675 Published 2018-01-01 No fix listed CWE-79

TI-2005-04253 CVE-2005-4510 · GHSA-9772-8vcx-jgfq

Directory traversal vulnerability in server.np in NetPublish Server 7 allows remote…

LOW 28

Directory traversal vulnerability in server.np in NetPublish Server 7 allows remote attackers to read arbitrary files via "../" sequences in the template parameter.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0291 Published 2005-12-23 No fix listed

Open these records in search →

Critical	0
High	8
Medium	2
Low	0
No CVSS	0