Aggregates CVE and security vulnerability intelligence across all opswat-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk cross-site scripting and vendor risk buffer overflow and related problems; some flaws may lead to vendor impact application crash, affecting vendor surface production workloads scenarios.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2024-57695 | An issue in Agnitum Outpost Security Suite 7.5.3 (3942.608.1810) and 7.6 (3984.693.1842) allows a local attacker to execute arbitrary code via the lock function. The manufacturer fixed the vulnerability in version 8.0 (4164.652.1856) from December 17, 2012. | [email protected] | 7.7 | 0.04% | 2025-11-11 | 2026-01-02 |
| CVE-2023-36659 | An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of service (loss of communication). | [email protected] | 9.8 | 2.41% | 2023-09-15 | 2024-11-21 |
| CVE-2023-36657 | An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation. | [email protected] | 9.8 | 0.50% | 2023-09-15 | 2024-11-21 |
| CVE-2023-36658 | An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally. | [email protected] | 7.8 | 0.05% | 2023-09-15 | 2024-11-21 |
| CVE-2022-40778 | A stored Cross-Site Scripting (XSS) vulnerability in OPSWAT MetaDefender ICAP Server before 4.13.0 allows attackers to execute arbitrary JavaScript or HTML because of the blocked page response. | [email protected] | 5.4 | 0.35% | 2022-09-19 | 2024-11-21 |
| CVE-2022-32272 | OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resulting in privilege escalation. | [email protected] | 9.8 | 21.20% | 2022-06-09 | 2024-11-21 |
| CVE-2022-32273 | As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate filenames on the server. | [email protected] | 4.3 | 0.15% | 2022-06-08 | 2024-11-21 |
| CVE-2018-16275 | OPSWAT MetaDefender before v4.11.2 allows CSV injection. | [email protected] | 7.8 | 0.27% | 2018-08-31 | 2024-11-21 |