Vulnerabilities

TI-2024-02942 CVE-2024-3142 · GHSA-mcgw-94j6-6g4q

Clavister E10/E80 Setting cross-site request forgery

MEDIUM 53

A vulnerability was found in Clavister E10 and E80 up to 14.00.10 and classified as problematic.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00292 Published 2024-04-02 No fix listed CWE-352

TI-2024-02941 CVE-2024-3141 · GHSA-h2vw-qxx3-m3jv

Clavister E10/E80 Misc Settings Page MiscSettings cross site scripting

MEDIUM 46

A vulnerability has been found in Clavister E10 and E80 up to 14.00.10 and classified as problematic.

CVSS 3.1LOW 2.4 Network High privileges User interaction EPSS 0.00493 Published 2024-04-01 No fix listed CWE-79

TI-2018-06313 CVE-2018-8753 · GHSA-fgp3-qvm3-xhqf

The IKEv1 implementation in Clavister cOS Core before 11.00.11, 11.20.xx before 11.20.06…

LOW 30

The IKEv1 implementation in Clavister cOS Core before 11.00.11, 11.20.xx before 11.20.06, and 12.00.xx before 12.00.09 allows remote attackers to decrypt RSA-encrypted nonces by leveraging a Bleichenbacher attack.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.01634 Published 2018-08-15 No fix listed

TI-2007-03689 CVE-2007-3805 · GHSA-5c2p-fpg9-rg5f

The IKE implementation in Clavister CorePlus before 8.80.03, and 8.80.00, does not…

LOW 26

The IKE implementation in Clavister CorePlus before 8.80.03, and 8.80.00, does not properly validate certificates during IKE negotiation, which allows remote attackers to cause a denial of service (gateway stop) via cert…

CVSS 2.0MEDIUM 5.4 Network No auth Interaction — EPSS 0.00879 Published 2007-07-16 No fix listed CWE-310

TI-2007-03688 CVE-2007-3804 · GHSA-2hx7-vxgc-r4p4

The AntiVirus engine in the HTTP-ALG in Clavister CorePlus before 8.81.00 and 8.80.03…

LOW 27

The AntiVirus engine in the HTTP-ALG in Clavister CorePlus before 8.81.00 and 8.80.03 might allow remote attackers to bypass scanning via small files.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01949 Published 2007-07-16 No fix listed CWE-264

TI-2007-03687 CVE-2007-3803 · GHSA-rfrf-3h83-9qr2

The SMTP ALG in Clavister CorePlus before 8.80.04, and 8.81.00, does not properly parse…

MEDIUM 47

The SMTP ALG in Clavister CorePlus before 8.80.04, and 8.81.00, does not properly parse SMTP commands in certain circumstances, which allows remote attackers to bypass address blacklists.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.02262 Published 2007-07-16 No fix listed

TI-2005-03708 CVE-2005-3915 · GHSA-r32j-hx54-9256

The Internet Key Exchange version 1 (IKEv1) implementation in Clavister Client Web allows…

LOW 38

The Internet Key Exchange version 1 (IKEv1) implementation in Clavister Client Web allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets, as demonstrated by the…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02762 Published 2005-11-30 No fix listed