Vendors / Ureport Project Records 6 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 3
CVSS high 2
Exploited now Ureport Project records in CISA KEV No Ureport Project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 80
ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted.
CVSS 3.1 CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01209 · Published 2023-02-13 · No fix listed CWE-22
Priority HIGH 69
An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.
CVSS 3.1 HIGH 7.8· Local · No auth · User interaction · EPSS 0.00926 · Published 2023-02-14 · No fix listed CWE-611
Priority MEDIUM 46
An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01781 · Published 2021-09-15 · No fix listed CWE-22
Priority MEDIUM 46
UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02183 · Published 2021-09-15 · No fix listed CWE-863
Priority MEDIUM 41
An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server by inserting a crafted path.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00948 · Published 2023-11-28 · No fix listed CWE-22
Priority LOW 26
UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0085 · Published 2021-09-15 · No fix listed CWE-918
Open these records in search → All records by CVSS severity
3 2 1 0 0
THREATIST.IORead the docs