Design/Logic Flaw

reg.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code'==1, which makes it possible to bypass the CAPTCHA via an empty $POST'captcha'...

CVE-2017-9090

reg.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code'==1, which makes it possible to bypass the CAPTCHA via an empty $POST'captcha'...

CVE-2017-9091

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code' == 1, which leads to CAPTCHA bypass by emptying $POST'captcha'...

CVE-2017-9090

reg.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code'==1, which makes it possible to bypass the CAPTCHA via an empty $POST'captcha'...

CVE-2017-9091

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code' == 1, which leads to CAPTCHA bypass by emptying $POST'captcha'...

CVE-2017-9091

The CVE-2017-9091 entry concerns Allen Disk 1.6: /admin/loginc.php does not verify isset($_SESSION['captcha']['code']) before processing, enabling CAPTCHA bypass by clearing $_POST['captcha']. The Red Hat and NVD records confirm the same issue; no public exploit details or patches are described i...

CVE-2017-9090

The CVE-2017-9090 issue affects Allen Disk 1.6’s reg.php, where there is no proper check of isset($_SESSION['captcha']['code']), enabling bypass of CAPTCHA via an empty $_POST['captcha']. The vulnerability is documented across multiple feeds (NVD entry with CVSSv2/3 scores indicating low–high imp...

Allen Disk Cross-Site Scripting Vulnerability

Allen Disk is a free, open source cloud-based hard disk product that features encrypted file storage, online preview, file sharing and more. A cross-site scripting vulnerability exists in the 'id' parameter of the downfile.php file in Allen Disk version 1.6. A remote attacker can exploit this...

Allen Disk Cross-Site Request Forgery Vulnerability

Allen Disk is a free, open source cloud-based hard disk product that features encrypted file storage, online preview, file sharing and more. A cross-site request forgery vulnerability exists in the setpass.php file in Allen Disk version 1.6. A remote attacker can exploit this vulnerability to...

CVE-2017-8848

Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password...

CVE-2017-8848

Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password...

Design/Logic Flaw

Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password...

CVE-2017-8848

Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password...

CVE-2017-8848

Summary (CVE-2017-8848): Allen Disk 1.6 contains a cross-site request forgery (CSRF) in setpass.php that can change a password. Multiple sources (CNVD-2017-07083, NVD entry, Red Hat listing) confirm the vulnerability in Allen Disk 1.6 and its CSRF nature, but the connected documents do not provid...

CVE-2017-8832

Allen Disk 1.6 has XSS in the id parameter to downfile.php...

CVE-2017-8832

Allen Disk 1.6 has XSS in the id parameter to downfile.php...

CVE-2017-8832

Allen Disk 1.6 has XSS in the id parameter to downfile.php...

CVE-2017-8832

Allen Disk 1.6 has a Cross-Site Scripting (XSS) vulnerability in the id parameter of downfile.php. The connected records consistently describe this XSS flaw for Allen Disk 1.6, but none of the provided documents supply details on exploitation methods, affected versions beyond 1.6, specific root c...