CVE-2019-9944

In Open Microscopy Environment OMERO.server 5.0.0 through 5.6.0, the reading of files from imported image filesets may circumvent OMERO permissions restrictions. This occurs because the Bio-Formats feature allows an image file to have embedded pathnames...

CVE-2019-16245

OMERO before 5.6.1 makes the details of each user available to all users...

CVE-2020-6752

In OMERO before 5.6.1, group owners can access members' data in other groups...

CVE-2019-9943

In ome.services.graphs.GraphTraversal.findObjectDetails in Open Microscopy Environment OMERO.server 5.1.0 through 5.6.0, permissions on OMERO model objects may be circumvented during certain operations such as move and delete, because group permissions are mishandled...

PYSEC-2020-244

OMERO.web before 5.6.3 optionally allows sensitive data elements e.g., a session key to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target...

Design/Logic Flaw

OMERO before 5.6.1 makes the details of each user available to all users...

Design/Logic Flaw

In OMERO before 5.6.1, group owners can access members' data in other groups...

CVE-2020-6752

In OMERO before 5.6.1, group owners can access members' data in other groups...

CVE-2020-6752

CVE-2020-6752 affects OMERO.server prior to 5.6.1. According to the connected CNVD entries, group owners can access members’ data in other groups, revealing an information-disclosure risk due to a pre-5.6.1 access-control issue. The vulnerability is described across sources as existing in OMERO.s...

CVE-2019-16245

OMERO before 5.6.1 makes the details of each user available to all users...

CVE-2019-16245

The CVE affects OMERO server prior to version 5.6.1, where per-user details are inadvertently exposed to all users. The underlying issue is an information-disclosure flaw in OMERO.server (before 5.6.1). Exploitation would reveal user-specific details to unauthorized users. Remediation per public ...

CVE-2020-7932

CVE-2020-7932 affects OMERO.web prior to 5.6.3. The issue allows sensitive data elements (e.g., a session key) to be passed in URL query parameters. If a user is lured into clicking a malicious link, these parameters can be exposed in the Referer header seen by the target, and information in the ...

Cross site request forgery (csrf)

OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protection...

CVE-2014-7198

OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protection...

CVE-2014-7198

CVE-2014-7198 affects OMERO prior to 5.0.6, where the web interface framework lacks CSRF protection, enabling multiple CSRF vulnerabilities. The root cause is missing CSRF protection in the OMERO web UI, exposing actions initiated by forged requests to potentially impact confidentiality, integrit...

CVE-2014-7198

OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protection...

Open Microscopy Environment OMERO.web Information Disclosure Vulnerability

Open Microscopy Environment OMERO.web is a set of open source image management platform for Web applications. The platform supports a variety of image file formats , and image management , viewing and editing operations . An information disclosure vulnerability exists in the login form and change...

Open Microscopy Environment OMERO.server Information Disclosure Vulnerability

Open Microscopy Environment OMERO.server is an open source image management platform. The platform supports a variety of image file formats , and image management , viewing and editing operations. An information disclosure vulnerability exists in Open Microscopy Environment OMERO.server versions...

CVE-2018-1000633

The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the login form and change password form that can result in User's password being revealed. Attacker can log in as that user. This attack appear to be exploitable vi...

CVE-2018-1000634

The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains an Improper Access Control vulnerability in User management that can result in administrative user with privilege restrictions logging in as a more powerful administrator. This attack appear to be exploitable via Use use...