83 matches found
CVE-2024-57587
Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to /api/auth/login...
CVE-2024-55062
Code Injection vulnerability in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote unauthenticated attackers to execute arbitrary code to /api/license/sendlicense/...
CVE-2024-53356
Weak JWT Secret vulnerabilitiy in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote attackers to generate JWT for privilege escalation. The HMAC secret used for generating tokens is hardcoded as "somerandomaccesstoken". A weak HMAC secret poses a risk because attackers can use the...
CVE-2024-53355
Multiple incorrect access control issues in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers, with low privileges, to 1 add an admin user via the /api/user/addalias route; 2 modifiy a user via the /api/user/updatealias route; 4 delete users via the...
CVE-2024-53354
Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers to execute arbitrary SQL commands via the 1 user parameter to /api/management/findfilterlist; the 2 user or 3 filter parameter to /api/audit/findmetawatcher; the 4 user...
CVE-2024-53355
Multiple incorrect access control issues in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers, with low privileges, to 1 add an admin user via the /api/user/addalias route; 2 modifiy a user via the /api/user/updatealias route; 4 delete users via the...
CVE-2024-53357
Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers, with low privileges, to 1 add an admin user via the /api/user/addalias route; 2 modifiy a user via the /api/user/updatealiasroute; 4 delete users via the /api/user/delali...
CVE-2024-53357
Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers, with low privileges, to 1 add an admin user via the /api/user/addalias route; 2 modifiy a user via the /api/user/updatealiasroute; 4 delete users via the /api/user/delali...
CVE-2024-53354
Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers to execute arbitrary SQL commands via the 1 user parameter to /api/management/findfilterlist; the 2 user or 3 filter parameter to /api/audit/findmetawatcher; the 4 user...
CVE-2024-55062
Code Injection vulnerability in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote unauthenticated attackers to execute arbitrary code to /api/license/sendlicense/...
CVE-2024-57587
Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to /api/auth/login...
CVE-2024-55062
Code Injection vulnerability in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote unauthenticated attackers to execute arbitrary code to /api/license/sendlicense/...
CVE-2024-57587
Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to /api/auth/login...
EasyVirt DC Scope和EasyVirt CO2 Scope 安全漏洞
EasyVirt DC Scope and EasyVirt CO2 Scope are both products of the French company EasyVirt.EasyVirt DC Scope is a monitoring and management solution for VMware Virtualization VMware.EasyVirt CO2 Scope is a real-time monitoring and control solution for IT services, virtual machines and servers in...
CVE-2024-53357: Use of Hard-coded Credentials
Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers, with low privileges, to 1 add an admin user via the /api/user/addalias route; 2 modifiy a user via the /api/user/updatealiasroute; 4 delete users via the /api/user/delali...
PT-2025-2960 · Easyvirt · Easyvirt Dcscope
Name of the Vulnerable Software and Affected Versions: EasyVirt DCScope versions 8.6.0 and earlier CO2Scope versions 1.3.0 and earlier Description: The issue allows remote attackers to generate JSON Web Tokens JWTs for privilege escalation due to a weak JWT secret. The HMAC secret used for...
CVE-2024-53355
Multiple incorrect access control issues exist in EasyVirt DCScope (versions <= 8.6.0) and EasyVirt CO2Scope (versions
CVE-2024-53357
Multiple SQL injection vulnerabilities exist in EasyVirt DCScope (versions <= 8.6.0) and EasyVirt CO2Scope (versions
CVE-2024-53354: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers to execute arbitrary SQL commands via the 1 user parameter to /api/management/findfilterlist; the 2 user or 3 filter parameter to /api/audit/findmetawatcher; the 4 user...
CVE-2024-53354
Multiple SQL injection vulnerabilities exist in EasyVirt DCScope (version 8.6.0 and earlier) and EasyVirt CO2Scope (version 1.3.0 and earlier). These vulnerabilities allow remote authenticated attackers to execute arbitrary SQL commands by manipulating various parameters across numerous API endpo...