52 matches found
CVE-2024-50623
POC - CVE-2024-50623- Cleo 무제한 파일 업로드 및 다운로드 개요 CVE-2024-50623은 Cleo의 파일 전송 소프트웨어 제품인 Cleo Harmony, Cleo VLTrader, Cleo LexiCom의 5.8.0.21 이전 버전에서 확인된 치명적인 취약점입니다. 이 결함으로 인해 무제한 파일 업로드 및 다운로드가 가능해지며, 잠재적으로 원격 코드 실행으로 이어질 수 있습니다. 영향을 받는 장치 Cleo Harmony 5.8.0.21 이전 버전 Cleo VLTrader 5.8.0.21 이전 버전 Cl...
Cleo Harmony < 5.8.0.24 - File Upload Vulnerability
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory. id: CVE-2024-55956 info: name: Cleo Harmony...
CVE-2026-84114
creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:03+00:00| seen| https://www.acn.gov.it/portale/w/cleo-harmony-disponibile-poc-per-la-cve-2026-84115...
Cleo Harmony < 5.8.0.21 - Arbitary File Read
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution. id: CVE-2024-50623 info: name: Cleo Harmony 5.8.0.21 - Arbitary File Read author: DhiyaneshDK severity: high...
The vulnerability of the /api/connections file of the JWT Refresh Token Handler software platform for automated file exchange with Cleo Harmony allows a malicious actor to escalate their privileges and gain unauthorized access to protected information.
The vulnerability of the /api/connections file of the JWT Refresh Token Handler component of the software platform for automated file exchange in Cleo Harmony is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to enhance their privileges and gain...
CVE-2026-84114
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been...
CVE-2026-84115
A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...
CVE-2026-84115 Cleo Harmony JWT Refresh Token connections privileges management
A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...
CVE-2026-84115
Cleo Harmony versions up to 5.8.1.10 are affected by an improper privilege management vulnerability in the JWT Refresh Token Handler component within the /api/connections file. Manipulation of the Bearer argument allows a remote, unauthenticated attacker to gain excessive privileges, with the sco...
CVE-2026-84115 Cleo Harmony JWT Refresh Token connections privileges management
A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...
EUVD-2026-69383
A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...
CVE-2026-84114 Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been...
CVE-2026-84114
Cleo Harmony versions up to 5.8.1.10 contain an improper authentication vulnerability in the SAML Authentication component, specifically in the function LocalUserUtil.getNativeUserByAssertions . Manipulation of the Email argument allows a remote attacker with low privileges to bypass authenticati...
EUVD-2026-69237
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been...
CVE-2026-84114 Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been...
CVE-2026-84115: Improper Privilege Management
A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...
CVE-2026-84114: Improper Authentication
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been...
PT-2026-84285
Name of the Vulnerable Software and Affected Versions Cleo Harmony versions prior to 5.8.1.11 Description An issue exists in the SAML Authentication component where manipulation of the Email argument within the LocalUserUtil.getNativeUserByAssertions function allows for improper authentication...
PT-2026-84292
Name of the Vulnerable Software and Affected Versions Cleo Harmony versions 5.8.1.0 through 5.8.1.10 Description An issue exists in the JWT JSON Web Token refresh token handler within the /api/connections endpoint. A remote attacker can manipulate the Bearer argument in HTTP headers to bypass...
CVE-2024-55956
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory...