Vltrader vulnerabilities

2 known vulnerabilities in Vltrader from Cleo. 2 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Cleo Multiple Products Unauthenticated File Upload Exploited

  CVE-2024-55956Dec 13, 2024CleoEPSS 94%

  In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

• 9.8 Critical severity

  Cleo Multiple Products Unrestricted File Upload Exploited

  CVE-2024-50623Oct 28, 2024CleoEPSS 98.6%

  In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.