665 matches found
Command Injection
rdiffweb is vulnerable to command injection. The vulnerability exists in notification.py due to lack of character sanitisation in SSH key names which allows an attacker to inject a hyperlink that allows an attacker to redirect victim to malicious website...
GHSA-83PM-7V48-5JP4 rdiffweb vulnerable to Special Element Injection
In rdiffweb prior to 2.5.5, lack of sanitisation of characters in SSH key name could allow attacker to inject a hyperlink injection that could allow attacker to redirect victim to malicious websites...
GHSA-H5WP-JRQC-CWWX rdiffweb vulnerable to Open Redirect
Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5...
rdiffweb vulnerable to Open Redirect
Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5...
GHSA-WF33-6X33-WCF9 rdiffweb vulnerable to Authentication Bypass by Primary Weakness
In rdiffweb prior to 2.5.5, the username field is not unique to users. This allows exploitation of primary key logic by creating the same name with different combinations & may allow unauthorized access...
rdiffweb vulnerable to Special Element Injection
In rdiffweb prior to 2.5.5, lack of sanitisation of characters in SSH key name could allow attacker to inject a hyperlink injection that could allow attacker to redirect victim to malicious websites...
rdiffweb has no rate limit on resend email feature
rdiffweb prior to 2.5.5 has no rate limit on the "resend email feature" while enable or disable 2FA from /prefs/mfa endpoint...
GHSA-7Q4R-X5QG-MMCP rdiffweb has no rate limit on resend email feature
rdiffweb prior to 2.5.5 has no rate limit on the "resend email feature" while enable or disable 2FA from /prefs/mfa endpoint...
rdiffweb vulnerable to Authentication Bypass by Primary Weakness
In rdiffweb prior to 2.5.5, the username field is not unique to users. This allows exploitation of primary key logic by creating the same name with different combinations & may allow unauthorized access...
CVE-2022-4719
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5...
CVE-2022-4723
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5...
CVE-2022-4720
Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5...
CVE-2022-4722
Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5...
PYSEC-2022-43008
Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5...
Open redirect
Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5...
Design/Logic Flaw
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5...
PYSEC-2022-43007
Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository ikus060/rdiffweb prior to 2.5.5...
PYSEC-2022-43005
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5...