Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 61

Export CSV
CVE-2021-47822

DiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service Path

DiskBoss Service 12.2.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path by placing malicious executables in potential path locations to gain system-level access during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Diskboss Flexense
Products
Diskboss Service Diskboss
CVE-2021-47807

Sync Breeze 13.6.18 - 'Multiple' Unquoted Service Path

Sync Breeze 13.6.18 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in service binaries located in 'Program Files' directories to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense Syncbreeze
Products
Sync Breeze Syncbreeze Sync Breeze
CVE-2021-47806

Dup Scout 13.5.28 - 'Multiple' Unquoted Service Path

Dup Scout 13.5.28 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Dup Scout Server\bin\dupscts.exe' to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Dupscout Flexense
Products
Dup Scout Dup Scout Dupscout
CVE-2018-25307

SysGauge Pro 4.6.12 Local Buffer Overflow SEH

SysGauge Pro 4.6.12 contains a local buffer overflow vulnerability in the Register function that allows local attackers to overwrite the structured exception handler by supplying a crafted unlock key. Attackers can inject shellcode through the Unlock Key field during registration to execute arbitrary code with application privileges.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Flexense Sysgauge
Products
Sysgauge Sysgauge Pro
CVE-2025-34108

Disk Pulse Enterprise 9.0.34 Login Stack Buffer Overflow

A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.

CVSS 4.0 · 8.6 High EPSS 1.4% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse
CVE-2018-25313

SysGauge 4.5.18 Local Denial of Service via Proxy Configuration

SysGauge 4.5.18 contains a buffer overflow vulnerability in the proxy configuration handler that allows local attackers to cause a denial of service by supplying an oversized string. Attackers can inject a large payload through the Proxy Server Host Name field in the Options menu to crash the application.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Flexense Sysgauge
Products
Sysgauge Sysgauge
CVE-2025-59901

authenticated reflected XSS vulnerability in Sync Breeze Enterprise Server

Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of the 'monitor_directory' parameter sent by POST. An attacker could exploit this weakness to send malicious content to an authenticated user and steal information from their session.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Sync Breeze Enterprise Server
CVE-2025-34105

DiskBoss Enterprise Stack-Based Buffer Overflow RCE

A stack-based buffer overflow vulnerability exists in the built-in web interface of DiskBoss Enterprise versions 7.4.28, 7.5.12, and 8.2.14. The vulnerability arises from improper bounds checking on the path component of HTTP GET requests. By sending a specially crafted long URI, a remote unauthenticated attacker can trigger a buffer overflow, potentially leading to arbitrary code execution with SYSTEM privileges on vulnerable Windows hosts.

CVSS 4.0 · 10 Critical EPSS 1.7% KEV · Not listed
Vendors
Flexense
Products
Diskboss
CVE-2020-36879

Flexsense DiskBoss Service Unquoted Service Path Vulnerability

Flexsense DiskBoss 11.7.28 allows unauthenticated attackers to elevate their privileges using any of its services, enabling remote code execution during startup or reboot with escalated privileges. Attackers can exploit the unquoted service path vulnerability by specifying a malicious service name in the 'sc qc' command, allowing them to execute arbitrary system commands.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense Flexsense
Products
Diskboss Diskboss
CVE-2023-53873

SyncBreeze 15.2.24 Denial of Service via Login Endpoint Overflow

SyncBreeze 15.2.24 contains a denial of service vulnerability in the login authentication mechanism that allows attackers to crash the service. Attackers can send an oversized password parameter with repeated 'password=' values to overwhelm the login endpoint and potentially disrupt service availability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Syncbreeze
CVE-2020-36946

SyncBreeze 10.0.28 - 'login' Denial of Service

SyncBreeze 10.0.28 contains a denial of service vulnerability in the login endpoint that allows remote attackers to crash the service. Attackers can send an oversized payload in the login request to overwhelm the application and potentially disrupt service availability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Syncbreeze
CVE-2020-36880

Flexsense DiskBoss 'Reports and Data Directory' Buffer Overflow

Flexsense DiskBoss 7.7.14 contains a local buffer overflow vulnerability in the 'Reports and Data Directory' field that allows an attacker to execute arbitrary code on the system.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Flexense Flexsense
Products
Diskboss Diskboss
CVE-2021-47809

Disk Sorter Enterprise 13.6.12 - 'Disk Sorter Enterprise' Unquoted Service Path

Disk Sorter Enterprise 13.6.12 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Disk Sorter Enterprise\bin\disksrs.exe' to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Disksorter Flexense
Products
Disk Sorter Disk Sorter
CVE-2021-47805

Disk Savvy 13.6.14 - 'Multiple' Unquoted Service Path

Disk Savvy 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in service binaries to inject malicious executables that will be run with elevated LocalSystem privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Disksavvy Flexense
Products
Disk Savvy Disksavvy Enterprise Disksavvy
CVE-2020-36930

SysGauge 7.9.18 - ' SysGauge Server' Unquoted Service Path

SysGauge Server 7.9.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\SysGauge Server\bin\sysgaus.exe' to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Sysgauge
CVE-2020-36927

DiskPulse 13.6.14 - Unquoted Service Path

DiskPulse Enterprise 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Disk Pulse Enterprise\bin\diskpls.exe' to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Diskpulse
CVE-2020-37100

Sync Breeze Enterprise 12.4.18 - Unquoted Service Path

Sync Breeze Enterprise 12.4.18 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path by placing malicious executables in specific file system locations to hijack the service startup process.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense Syncbreeze
Products
Syncbreeze Sync Breeze
CVE-2025-59891

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to change a user's password or create users via '/setup_login?sid=', affecting the 'username', 'password', and 'cpassword' parameters.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59892

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete commands individually via '/delete_command?sid=', using the 'cid' parameter.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59893

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to rename commands via '/rename_command?sid=', affecting the 'command_name' parameter.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more