665 matches found
RDiffWeb vulnerable to Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0...
WS-2022-0404
A 2FA bypass vulnerability was discovered in in ikus060/rdiffweb prior to 2.5.0. Due to lack of code and email integration , old confirmation codes still remain valid on email change...
WS-2022-0346
An Open Redirect vulnerability was found in ikus060/rdiffweb due to improper data filtering process. Attackers can redirect users to any website and perform phishing attacks...
WS-2022-0344
in rdiffweb a CSRF vulnerability was discovered, which targets a critical function email changing and may result in an Account Takeover...
WS-2022-0340
Bypass IP detection to brute-force password in ikus060/rdiffweb prior to 2.4.4. In login API, by default, the IP address will be blocked when the user tries to login incorrectly more than 5 times but the mechanism can be bypassed by abuse X-Forwarded-For header to bypass IP dectection and perform...
WS-2021-0640
Cross-Site Request Forgery CSRF in rdiffweb beofre 2.3.7...
Access Control Bypass
Overview rdiffweb is an A web interface to rdiff-backup repositories. Affected versions of this package are vulnerable to Access Control Bypass via the API authentication process. An attacker can gain unauthorized access to other users' data and perform actions on their behalf by using any valid ...
CVE-2025-67796
IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users...
CVE-2025-67796: Improper Access Control
IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users...
Rdiffweb Access Control Vulnerability
Rdiffweb is a web application personally developed by Patrik Dufresne from the United States. It allows for quick access to your files through an efficient web interface. Versions of Rdiffweb prior to 2.10.5 contained a security vulnerability related to access control. This vulnerability stemmed...
EUVD-2025-209635
IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users...
CVE-2025-67796
The IKUS Rdiffweb software (versions prior to 2.10.6 ) contains an improper authorization flaw. The vulnerability stems from the API's failure to enforce a binding between the authenticated subject and the targeted user or tenant. An attacker possessing a valid or stolen access token can exploit ...
CVE-2025-67796
IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users...
CVE-2025-67796
IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users...
CVE-2025-67796
IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users...
EUVD-2007-2739
Malware in sbrugna...
EUVD-2022-0236
Malicious code in bioql PyPI...
EUVD-2022-0243
Malicious code in bioql PyPI...