PatchTheCVEsapphireims vulnerabilities
Recent CVEs affecting sapphireims products. 11 tracked.
sapphireims has 11 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 0. Most recent: 2021-08-11. Highest priority: CVE-2020-25565 (score 65/100).
- CVE-2020-25566 CRITICAL 9.8 DOWNGRADE In SapphireIMS 5.0, it is possible to take over an account by sending a request to the Save_Password form as s
- CVE-2020-25565 CRITICAL 9.8 DOWNGRADE In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: i
- CVE-2020-25564 HIGH 8.8 DOWNGRADE In SapphireIMS 5.0, it is possible to create local administrator on any client with credentials of a non-privi
- CVE-2020-25563 CRITICAL 9.8 DOWNGRADE In SapphireIMS 5.0, it is possible to create local administrator on any client without requiring any credentia
- CVE-2020-25562 MEDIUM 6.5 DOWNGRADE In SapphireIMS 5.0, there is no CSRF token present in the entire application
- CVE-2020-25561 HIGH 7.8 DOWNGRADE SapphireIMS 5 utilized default sapphire:ims credentials to connect the client to server
- CVE-2020-25560 CRITICAL 9.8 DOWNGRADE In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: i
- CVE-2017-16632 HIGH 7.5 DOWNGRADE In SapphireIMS 4097_1, the password in the database is stored in Base64 format.
- CVE-2017-16631 MEDIUM 6.5 DOWNGRADE In SapphireIMS 4097_1, a guest user is able to change the password of an administrative user by utilizing an I
- CVE-2017-16630 HIGH 8.8 DOWNGRADE In SapphireIMS 4097_1, a guest user can create a local administrator account on any system that has SapphireIM
- CVE-2017-16629 HIGH 7.5 DOWNGRADE In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors
FAQ
How do I fix sapphireims vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sapphireims being exploited right now?
None of the tracked sapphireims CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sapphireims CVE should I patch first?
CVE-2020-25565 currently ranks highest (65/100): In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: i.