FreshRSS Fever API - Exposure Detection

Detected an exposed FreshRSS instance with the Fever API enabled, which could allow unauthorized access to RSS feed data and user-related information via accessible Fever-compatible API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detected an exposed FreshRSS instance with the Fever AP...

CVE-2022-23497 Insecure file access in FreshRSS

FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...

FreshRSS information leakage vulnerability

FreshRSS is a free, self-hosted RSS aggregator from the FreshRSS open source. An information disclosure vulnerability exists in versions of FreshRSS prior to 1.20.2 that stems from a remote user being able to access user configuration files, such configurations contain hashed passwords for the we...

PT-2022-16030 · Freshrss · Freshrss

Name of the Vulnerable Software and Affected Versions: FreshRSS versions prior to 1.20.2 Description: FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords of the...