xceedium vulnerabilities

Products

• xsuite 6

Latest xceedium CVEs

Newest publication first

1. CVE-2015-4664 An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.

   Published 2018-06-18

   Critical·CVSS 9.8 EPSS 20.2% Public exploit

   An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.

2. CVE-2015-4667 Multiple hardcoded credentials in Xsuite 2.x.

   Published 2017-09-25

   Critical·CVSS 9.8 EPSS 11.1% Public exploit

   Multiple hardcoded credentials in Xsuite 2.x.

3. CVE-2015-4668 Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.

   Published 2017-09-25

   Medium·CVSS 6.1 EPSS 6.7% Public exploit

   Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.

4. CVE-2015-4669 The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the system.

   Published 2017-09-25

   High·CVSS 7.8 EPSS 1.1% Public exploit

   The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the system.

5. CVE-2015-4665 Cross-site scripting (XSS) vulnerability in ajax_cmd.php in Xceedium Xsuite 2.4.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the fileName parameter.

   Published 2015-08-13

   Medium·CVSS 4.3 EPSS 3.3% Public exploit

   Cross-site scripting (XSS) vulnerability in ajax_cmd.php in Xceedium Xsuite 2.4.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the fileName parameter.

6. CVE-2015-4666 Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files via a ....// (quadruple dot double slash) in the log...

   Published 2015-08-13

   Medium·CVSS 5.0 EPSS 16.2% Public exploit

   Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files via a ....// (quadruple dot double slash) in the logFile parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.