io.micronaut.aws:micronaut-function-aws-alexa (>=1.1.0.m2, <=1.1.2), io.micronaut.aws:micronaut-function-aws-api-proxy (>=1.1.0.m2, <=1.1.2) +49 more potentially affected by CVE-2022-21700 via io.micronaut:micronaut-http (1.0.4)

io.micronaut:micronaut-http MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http and may be impacted: - io.micronaut.aws:micronaut-function-aws-alexa =1.1.0.m2, =1.1.0.m2, =1.1.0.m2, =1.0.4, =1.0.0.rc3,...

io.micronaut.aws:micronaut-aws-alexa (>=2.0.0.m1, <=2.0.0.m3), io.micronaut.aws:micronaut-aws-alexa-httpserver (>=2.0.0.m1, <=2.0.0.m3) +36 more potentially affected by CVE-2022-21700 via io.micronaut:micronaut-http (2.0.0.m2)

io.micronaut:micronaut-http MAVEN version 2.0.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http and may be impacted: - io.micronaut.aws:micronaut-aws-alexa =2.0.0.m1, =2.0.0.m1, =2.0.0.m1, =2.0.0.m1, =2.0.0.m1, =2.0.0.m1,...

Cross site request forgery (csrf)

Cozy version 2 has XSS allowing remote attackers to obtain administrative access via JavaScript code in the url parameter to the /api/proxy URI, as demonstrated by an XMLHttpRequest call with an 'email:"email protected"' request, which can be followed by a password reset...

PT-2018-17760

Name of the Vulnerable Software and Affected Versions Cozy version 2 Description The issue allows remote attackers to obtain administrative access via JavaScript code in the url parameter to the "/api/proxy" API endpoint. This can be achieved through an XMLHttpRequest call with a request containi...

CVE-2018-6824: Improper Neutralization of Input During Web Page Generation

Cozy version 2 has XSS allowing remote attackers to obtain administrative access via JavaScript code in the url parameter to the /api/proxy URI, as demonstrated by an XMLHttpRequest call with an 'email:"[email protected]"' request, which can be followed by a password reset...