CVE-2024-40404

Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are established...

CVE-2024-40405

An incorrect access control vulnerability exists in Cybele Software Thinfinity Workspace versions prior to v7.0.3.109 . This flaw allows an attacker to gain unauthorized access to a secondary broker by sending a crafted request . The vulnerability has been identified in several databases, includi...

CVE-2024-40410

Cybele Software Thinfinity Workspace versions prior to v7.0.2.113 are affected by a vulnerability involving a hardcoded cryptographic key used for encryption. This embedded key potentially allows for unauthorized access or exploitation. To mitigate the risks associated with this hardcoded key, us...

CVE-2024-40405

Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request...

CVE-2024-40410

Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption...

CVE-2024-40408: Missing Authentication for Critical Function

Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allows attackers to create arbitrary user profiles with elevated privileges...

CVE-2024-40408

Cybele Software Thinfinity Workspace versions prior to v7.0.2.113 contain an access control issue within the Create Profile section. This vulnerability allows an attacker to create arbitrary user profiles with elevated privileges , potentially leading to unauthorized access. To remediate this, us...

CVE-2024-40405: Missing Authentication for Critical Function

Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request...

CVE-2024-40408

Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allows attackers to create arbitrary user profiles with elevated privileges...

CVE-2024-40407

A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified vectors...

VulnCheck KEV: CVE-2021-45092

Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter...

CVE-2022-25227

Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing CORS vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse malicious site, to obtain an 'ID' that can be used to send websocket requests and achieve RCE...

CVE-2022-25227

Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing CORS vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse malicious site, to obtain an 'ID' that can be used to send websocket requests and achieve RCE...

CVE-2022-25227

Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing CORS vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse malicious site, to obtain an 'ID' that can be used to send websocket requests and achieve RCE...

Cross site scripting

Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing CORS vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse malicious site, to obtain an 'ID' that can be used to send websocket requests and achieve RCE...

CVE-2022-25227

Thinfinity VNC v4.0.0.1 is affected by a Cross-Origin Resource Sharing (CORS) flaw that can allow an unprivileged remote attacker, tricked into visiting a malicious site, to obtain an ID that can be used to send websocket requests and achieve remote code execution. The CVE description consistentl...

CVE-2022-25227

Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing CORS vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse malicious site, to obtain an 'ID' that can be used to send websocket requests and achieve RCE...

Cybele Software Thinfinity VNC 访问控制错误漏洞

Cybele Software Thinfinity VNC is a remote desktop software from Cybele Software. It allows remote access to Windows computers from all Web browsers and operating systems. A security vulnerability exists in Thinfinity VNC version v4.0.0.1, which stems from the inclusion of a Cross Domain Resource...

CVE-2022-25227: Origin Validation Error

Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing CORS vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse malicious site, to obtain an 'ID' that can be used to send websocket requests and achieve RCE...

Thinfinity VirtualUI 2.5.41.0 - IFRAME Injection Vulnerability

Exploit Title: Thinfinity VirtualUI 2.5.41.0 - IFRAME Injection Exploit Author: Daniel Morales Vendor: https://www.cybelesoft.com Software Link: https://www.cybelesoft.com/thinfinity/virtualui/ Version: Thinfinity VirtualUI " where "vpath=//" is the pointer to the external site to be iframed...