Vulnerabilities

TI-2021-18468 CVE-2021-41845 · GHSA-p43g-hhpp-v678

A SQL injection issue was discovered in ThycoticCentrify Secret Server before 11.0.000007.

LOW 30

A SQL injection issue was discovered in ThycoticCentrify Secret Server before 11.0.000007.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0068 Published 2021-10-01 No fix listed CWE-89

TI-2019-13361 CVE-2019-18357 · GHSA-x3g9-prx7-8c62

An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2).

LOW 29

An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00785 Published 2019-10-23 No fix listed CWE-79

TI-2019-13360 CVE-2019-18356 · GHSA-gx49-wwfx-7rfg

An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2).

LOW 29

An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00789 Published 2019-10-23 No fix listed CWE-79

TI-2019-13359 CVE-2019-18355 · GHSA-2h49-cj6v-q67p

An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.

MEDIUM 45

An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01514 Published 2019-10-23 No fix listed CWE-918

TI-2014-03999 CVE-2014-4861 · GHSA-cf26-68vj-rch5

The Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly…

MEDIUM 44

The Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly cleanup a temporary file that contains an encrypted password once a session has ended.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01169 Published 2018-03-09 No fix listed CWE-255

TI-2017-08682 CVE-2017-11725 · GHSA-24x7-gxr3-5r7r

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back…

LOW 25

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00567 Published 2017-07-29 No fix listed CWE-601

TI-2015-03038 CVE-2015-3443 · GHSA-vfrp-379g-5hwr

Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server…

LOW 21

Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or HTML via a password…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.0198 Published 2015-07-02 No fix listed CWE-79

TI-2015-03447 CVE-2015-4094 · GHSA-7h49-xvm6-m9x4

The Thycotic Password Manager Secret Server application through 2.3 for iOS does not…

LOW 27

The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.0059 Published 2015-06-02 No fix listed CWE-295

Vulnerabilities

Filters