Security Vulnerabilities
Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter.
CVSS Score
6.5
EPSS Score
0.0
Published
2025-08-06
An issue was discovered in 4C Strategies Exonaut 21.6. Passwords, stored in the database, are hashed without a salt.
CVSS Score
5.3
EPSS Score
0.0
Published
2025-08-06
A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'file_get_contents()' function call in '/api_vedo/template'.
CVSS Score
6.5
EPSS Score
0.001
Published
2025-08-06
A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser.
CVSS Score
6.1
EPSS Score
0.001
Published
2025-08-06
Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint.
CVSS Score
6.5
EPSS Score
0.001
Published
2025-08-06
4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF).
CVSS Score
6.5
EPSS Score
0.0
Published
2025-08-06
4C Strategies Exonaut before v22.4 was discovered to contain an access control issue.
CVSS Score
5.3
EPSS Score
0.0
Published
2025-08-06
4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions.
CVSS Score
6.5
EPSS Score
0.0
Published
2025-08-06
An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. Information disclosure can occur via an external HTTPS request.
CVSS Score
7.5
EPSS Score
0.0
Published
2025-08-06
Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges.
CVSS Score
7.8
EPSS Score
0.0
Published
2025-08-06