246 matches found
PT-2023-18533
Name of the Vulnerable Software and Affected Versions FreshRSS affected versions not specified Description FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in users/ /log api.txt in the case where the authentication fails. The iss...
FreshRSS log information leakage vulnerability
FreshRSS is a free, self-hosted RSS aggregator from FreshRSS Open Source. FreshRSS suffers from a log information disclosure vulnerability that stems from a user-supplied password being logged in plaintext in users//logapi.txt in the event of an authentication failure...
CVE-2023-22481: Insertion of Sensitive Information into Log File
FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in users//logapi.txt in the case where the authentication fails. The issues occurs in authorizationToUser in greader.php. If there is an issue with the request or the credentials,...
CVE-2022-23497
FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...
Double free
FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...
CVE-2022-23497 Insecure file access in FreshRSS
FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...
CVE-2022-23497 Insecure file access in FreshRSS
FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...
CVE-2022-23497
FreshRSS CVE-2022-23497 describes an information‑disclosure vulnerability where a remote user can access user configuration files. These files can contain hashed passwords for the web interface and, if using the API, hashed passwords for GReader and Fever APIs. Affected releases are prior to 1.20...
CVE-2022-23497
FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...
CVE-2022-23497 Insecure file access in FreshRSS
FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...
PT-2022-16030 · Freshrss · Freshrss
Name of the Vulnerable Software and Affected Versions: FreshRSS versions prior to 1.20.2 Description: FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords of the...
CVE-2022-23497: Exposure of Sensitive Information to an Unauthorized Actor
FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...
FreshRSS information leakage vulnerability
FreshRSS is a free, self-hosted RSS aggregator from the FreshRSS open source. An information disclosure vulnerability exists in versions of FreshRSS prior to 1.20.2 that stems from a remote user being able to access user configuration files, such configurations contain hashed passwords for the we...
CVE-2018-19782
Multiple cross-site scripting XSS vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the 1 c parameter or 2 a parameter...
CVE-2018-19782
Multiple cross-site scripting XSS vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the 1 c parameter or 2 a parameter...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the 1 c parameter or 2 a parameter...
FreshRSS Cross-Site Scripting Vulnerability
FreshRSS is an open source, self-hosted RSS aggregator with support. A cross-site scripting vulnerability exists in FreshRSS version 1.11.1. A remote attacker can exploit the vulnerability to inject arbitrary web script or HTML with the help of 'c' or 'a' parameter...
CVE-2018-19782
CVE-2018-19782: Multiple cross-site scripting (XSS) vulnerabilities in FreshRSS 1.11.1 affect GET requests by injecting scripts via the c parameter or the a parameter. The issue enables remote attackers to execute arbitrary web script/HTML in the context of the user session. Reported details come...