Improper access control

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...

CVE-2018-12642

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...

CVE-2018-12642

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...

CVE-2018-12642

Froxlor up to version 0.9.39.5 contains an Incorrect Access Control issue where tickets can be accessed by users who do not own them. The connected Red Hat, SUSE, GHSA, OSV, and CVE records corroborate this vulnerability family. The description does not provide root-cause details or a vendor patc...

CVE-2018-12642

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...

CVE-2018-12642

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...

PT-2018-11304

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 0.9.39.6 Description The issue is related to incorrect access control, allowing unauthorized access to tickets not owned by the current user. Recommendations For versions prior to 0.9.39.6, update to version 0.9.39.6 ...

CVE-2018-12642: Incorrect Permission Assignment for Critical Resource

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...

Froxlor 0.9.37 HTML Injection

Credits: John Page aka HyP3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/FROXLOR-0.9.37-HTML-INJECTION.txt + ISR: ApparitionSec Vendor: ============== www.froxlor.org Product: ============= Froxlor 0.9.37 Vulnerability Type: ===================...

CVE-2015-5959

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...

Default configuration

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...

CVE-2015-5959

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...

CVE-2015-5959

CVE-2015-5959 affects Froxlor prior to 0.9.33.2, where default installations could disclose the database password by reading the /logs/sql-error.log file. Multiple sources (NVD entry and FreeBSD VuXML) describe an unauthenticated information-disclosure scenario tied to the /logs directory permiss...

CVE-2015-5959

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...

PT-2017-6899

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 0.9.33.2 Description The issue allows remote attackers to obtain the database password by reading the /logs/sql-error.log file. Recommendations For versions prior to 0.9.33.2, update to version 0.9.33.2 or later to...

CVE-2015-5959: Exposure of Sensitive Information to an Unauthorized Actor

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...

Froxlor Password Reset Vulnerability

Froxlor is a web-based version of the server backend control panel developed by the Froxlor team, which supports a wide range of servers such as Apache, Lighttpd and Nginx. A security vulnerability exists in versions of Froxlor prior to 0.9.35 that stems from the program's use of the 'PHP rand'...

CVE-2016-5100

Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value...

CVE-2016-5100

Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value...

Design/Logic Flaw

Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value...