Cleo vulnerabilities
Published CVEs affecting Cleo products: 2 record(s), with severity, exploitation and fixes.
CVE-2024-55956
Critical · 9.8
KEV Urgent · 86 Public exploit Ransomware CWE-77 Dec 13, 2024
Cleo Multiple Products Unauthenticated File Upload Vulnerability
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
CVE-2024-50623
Critical · 9.8
KEV Urgent · 80 Public exploit Ransomware CWE-434 Oct 27, 2024
Cleo Multiple Products Unrestricted File Upload Vulnerability
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.