Thinfinity Virtualui
Approved changes feed: RSS · Atom
cpe:2.3:a:cybelesoft:thinfinity_virtualui:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Cybelesoft (8fcb1040-17c6-5823-86b0-f50590282b9e) |
|---|---|
| Product | Thinfinity Virtualui (dad8f226-e263-5430-8f1c-83f1f2d001c8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-45092 |
vulnerable | 2026-06-08 05:36:47.808668 |
Details available
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.
Published: 2021-12-16T03:07:32.000Z
Updated: 2024-08-04T04:32:13.635Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-44848 |
vulnerable | 2026-06-08 05:36:47.553552 |
Details available
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.
Published: 2021-12-13T01:08:27.000Z
Updated: 2024-08-04T04:32:12.899Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-44554 |
vulnerable | 2026-06-08 05:36:46.320518 |
Details available
Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest and krgtbt.
Published: 2021-12-20T08:31:42.000Z
Updated: 2024-08-04T04:25:16.743Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-16385 |
vulnerable | 2026-06-08 05:13:08.399230 |
Details available
Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?mimetype= substring. The victim user must load an application request to view a PDF, containing the malicious payload. This results in a reflected XSS payload being executed.
Published: 2020-06-04T15:29:35.000Z
Updated: 2024-08-05T01:17:39.409Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-16384 |
vulnerable | 2026-06-08 05:13:08.398709 |
Details available
Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration. This enables files outside of the web directory to be retrieved if the exact location is known and the user has permissions.
Published: 2020-06-04T15:30:34.000Z
Updated: 2024-08-05T01:17:39.417Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.