899 matches found
CVE-2022-3017
CVE-2022-3017 describes a Cross‑Site Request Forgery (CSRF) vulnerability in the Froxlor project (froxlor/froxlor) affecting versions prior to 0.10.38. The issue allows unauthorized actions to be performed in the authenticated context of Froxlor web applications. The available connected sources c...
CVE-2022-3017 Cross-Site Request Forgery (CSRF) in froxlor/froxlor
Cross-Site Request Forgery CSRF in GitHub repository froxlor/froxlor prior to 0.10.38...
PT-2022-20019 · Froxlor · Froxlor
Name of the Vulnerable Software and Affected Versions: froxlor versions prior to 0.10.38 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository froxlor/froxlor. CSRF is an attack that tricks a user into performing unintended actions on a web application that...
CVE-2022-3017: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF in GitHub repository froxlor/froxlor prior to 0.10.38...
Froxlor 跨站请求伪造漏洞
Froxlor is a lightweight server management software from the Froxlor team. A cross-site request forgery vulnerability exists in Froxlor versions prior to 0.10.38. An attacker could exploit this vulnerability to perform cross-site request forgery attacks...
Froxlor SQL injection vulnerability
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name...
GHSA-6FVW-X6GW-4WV8 Froxlor SQL injection vulnerability
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name...
GHSA-P29C-JPGJ-V57R Froxlor arbitrary code execution via the database configuration options
An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of backupExistingDatabase in install/lib/class.FroxlorInstall.php...
Froxlor arbitrary code execution via the database configuration options
An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of backupExistingDatabase in install/lib/class.FroxlorInstall.php...
GHSA-HVGF-2RF7-WRX9 Froxlor Information Disclosure
An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of createUserdataConf in...
Froxlor Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time,...
Froxlor Information Disclosure
An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of createUserdataConf in...
GHSA-J9WR-MJ69-CQMV Froxlor Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time,...
Froxlor guessable password reset token
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value...
GHSA-QJ6H-M7XC-R2V3 Froxlor guessable password reset token
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value...
Froxlor Incorrect Access Control
Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...
GHSA-R6G8-MQ9V-CGP4 Froxlor Incorrect Access Control
Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...
GHSA-G77V-M226-3F7G Froxlor PHP Object Injection vulnerability
Froxlor version = 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $POST'sslipandport'. This vulnerability appears to...
Froxlor PHP Object Injection vulnerability
Froxlor version = 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $POST'sslipandport'. This vulnerability appears to...
Cross-site Scripting (XSS)
froxlor/froxlor is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of input via the customermail GET parameter allowing an attacker to input HTML tags which will be reflected in the login webpage...