Ureport ProjectCVEs & Vulnerabilities
6 CVEs affecting Ureport Project products, tracked from the National Vulnerability Database, with CVSS/EPSS scores and exploitation status.
Most Affected Products
An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server by inserting a crafted path.
An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.
ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted.
An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.
UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page.
UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.