CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 1CVE-2024-0770 – European Chemicals Agency IUCLID Desktop Installer iuclid6.exe default permission
https://notcve.org/view.php?id=CVE-2024-0770
A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file iuclid6.exe of the component Desktop Installer. The manipulation leads to incorrect default permissions. The attack needs to be approached locally. VDB-251670 is the identifier assigned to this vulnerability. • https://imagebin.ca/v/7nx8zv3l62Kf https://vuldb.com/?ctiid.251670 https://vuldb.com/?id.251670 • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26546
https://notcve.org/view.php?id=CVE-2023-26546
European Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template Injection (SSTI) with a crafted template file. The attacker must have template manager permission. • https://iuclid6.echa.europa.eu https://iuclid6.echa.europa.eu/documents/1387205/1809530/note_v6.27.6.pdf/76545a65-e6be-6486-280a-7d7c3d2ad455?t=1677577170669 https://iuclid6.echa.europa.eu/download •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26089
https://notcve.org/view.php?id=CVE-2023-26089
European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5. • https://iuclid6.echa.europa.eu https://iuclid6.echa.europa.eu/documents/1387205/1809530/note_v6.27.6.pdf/76545a65-e6be-6486-280a-7d7c3d2ad455?t=1677577170669 https://iuclid6.echa.europa.eu/download • CWE-798: Use of Hard-coded Credentials •