Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Vembu Component: Offsite Dr Clear all filters
TI-2021-08264 CVE-2021-26474 · GHSA-jmcf-qq6f-fgvg

UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS

Priority LOW 39

Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00707 Published 2021-06-08 No fix listed CWE-352
TI-2021-08263 CVE-2021-26473 · GHSA-8x7w-j66g-cfqw

Unauthenticated arbitrary file upload and command execution in Vembu products

Priority MEDIUM 46

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01756 Published 2021-06-08 No fix listed CWE-434
TI-2021-08261 CVE-2021-26471 · GHSA-rpcc-jvgm-8vrr

Unauthenticated remote command execution in Vembu products

Priority MEDIUM 46

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02261 Published 2021-06-08 No fix listed