Vulnerabilities

TI-2024-16105 CVE-2024-24398 · GHSA-gfqf-9w98-7jmx

Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before…

HIGH 82

Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02024 Published 2024-02-06 Fixed in 2024.1.3 CWE-22

TI-2024-16104 CVE-2024-24397 · GHSA-9cgf-pxwq-2cpw

Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before…

MEDIUM 58

Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the ReportName field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00759 Published 2024-02-05 Fixed in 2024.1.2 CWE-79

TI-2024-16103 CVE-2024-24396 · GHSA-9m6m-c64r-w4f4

Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before…

MEDIUM 60

Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the search bar component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00829 Published 2024-02-05 Fixed in 2024.1.2 CWE-94

TI-2023-10686 CVE-2023-25262 · GHSA-f289-g9w2-9j5h

Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request…

HIGH 72

Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.009 Published 2023-03-28 No fix listed CWE-918

TI-2023-10684 CVE-2023-25260 · GHSA-jfmf-9mmf-25ww

Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.

HIGH 72

Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00844 Published 2023-03-28 No fix listed CWE-552

TI-2023-10687 CVE-2023-25263 · GHSA-v4pr-w7x8-m4mg

In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the…

MEDIUM 58

In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionstring stored in .mrt files since a static secret is used.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00234 Published 2023-03-27 No fix listed CWE-312

TI-2023-10685 CVE-2023-25261 · GHSA-fj34-r2c9-hq4p

Certain Stimulsoft GmbH products are affected by: Remote Code Execution.

HIGH 75

Certain Stimulsoft GmbH products are affected by: Remote Code Execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01903 Published 2023-03-27 No fix listed CWE-94

TI-2021-18979 CVE-2021-42777 · GHSA-gg9g-9v4f-9pj3

Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows…

MEDIUM 51

Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any machine that renders a report, including the application server or a user's local m…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01151 Published 2022-10-29 No fix listed CWE-209

TI-2020-12485 CVE-2020-15865 · GHSA-9m79-c3rf-x6vw

A Remote Code Execution vulnerability in Stimulsoft (aka Stimulsoft Reports)…

MEDIUM 50

A Remote Code Execution vulnerability in Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0 allows an attacker to encode C# scripts as base-64 in the report XML file so that they will be compiled and executed on the serve…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05116 Published 2020-08-18 No fix listed CWE-94

Vulnerabilities

Filters