Vulnerabilities > Thomsonreuters

DATE CVE VULNERABILITY TITLE RISK
2020-09-03 CVE-2019-10679 Incorrect Default Permissions vulnerability in Thomsonreuters Eikon 4.0.42144
Thomson Reuters Eikon 4.0.42144 allows all local users to modify the service executable file because of weak %PROGRAMFILES(X86)%\Thomson Reuters\Eikon permissions.
local
low complexity
thomsonreuters CWE-276
7.2
2020-01-15 CVE-2015-5952 Path Traversal vulnerability in Thomsonreuters Fatca
Directory traversal vulnerability in Thomson Reuters for FATCA before 5.2 allows remote attackers to execute arbitrary files via the item parameter.
network
low complexity
thomsonreuters CWE-22
critical
10.0
2020-01-06 CVE-2015-5951 Unrestricted Upload of File with Dangerous Type vulnerability in Thomsonreuters Fatca
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and execute system commands.
network
low complexity
thomsonreuters CWE-434
critical
9.0
2019-06-05 CVE-2019-8385 Path Traversal vulnerability in Thomsonreuters Concourse Matter Room and Firm Central Desktop
An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358.
network
low complexity
thomsonreuters CWE-22
7.5
2018-07-26 CVE-2018-14608 Missing Encryption of Sensitive Data vulnerability in Thomsonreuters Ultratax CS 2017
Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be inconsistent with some customers' expectations because the data is directly accessible in cleartext.
network
low complexity
thomsonreuters CWE-311
7.5
2018-07-26 CVE-2018-14607 Missing Encryption of Sensitive Data vulnerability in Thomsonreuters Ultratax CS 2017
Thomson Reuters UltraTax CS 2017 on Windows, in a client/server configuration, transfers customer records and bank account numbers in cleartext over SMBv2, which allows attackers to (1) obtain sensitive information by sniffing the network or (2) conduct man-in-the-middle (MITM) attacks via unspecified vectors.
network
low complexity
thomsonreuters CWE-311
7.5
2014-12-03 CVE-2014-9141 Permissions, Privileges, and Access Controls vulnerability in Thomsonreuters Fixed Assets CS
The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, which allows local users to execute arbitrary code by modifying this program.
local
low complexity
thomsonreuters CWE-264
7.2
2013-11-28 CVE-2013-5912 Code Injection vulnerability in Thomsonreuters Velocity Analytics Vhayu Analytic Server 6.94
VhttpdMgr in Thomson Reuters Velocity Analytics Vhayu Analytic Server 6.94 build 2995 allows remote attackers to execute arbitrary code via a URL in the fileName parameter during an importFile action.
network
low complexity
thomsonreuters CWE-94
critical
10.0