Co2scope vulnerabilities

5 known vulnerabilities in Co2scope from Easyvirt. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Co2scope: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-57587Jan 31, 2025Easyvirt

  Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to /api/auth/login.

• 9.8 Critical severity

  Co2scope: Improper Neutralization of Special Elements used in a Command

  CVE-2024-55062Jan 31, 2025EasyvirtEPSS 1.14%

  Code Injection vulnerability in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers to execute arbitrary code to /api/license/sendlicense/.

• 7.5 High severity

  Co2scope: Use of Hard-coded Credentials

  CVE-2024-53357Jan 31, 2025Easyvirt

  Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low privileges, to (1) add an admin user via the /api/user/addalias route; (2) modifiy a user via the /api/user/updatealiasrou

• 9.8 Critical severity

  Co2scope: Use of Hard-coded Credentials

  CVE-2024-53356Jan 31, 2025Easyvirt

  Weak JWT Secret vulnerabilitiy in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote attackers to generate JWT for privilege escalation. The HMAC secret used for generating tokens is hardcoded as "somerandomaccesstoken". A weak HMAC secret poses a r

• 8.8 High severity

  Co2scope: Improper Preservation of Permissions

  CVE-2024-53355Jan 31, 2025Easyvirt

  Multiple incorrect access control issues in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low privileges, to (1) add an admin user via the /api/user/addalias route; (2) modifiy a user via the /api/user/updatealias