Rdiffweb security vulnerabilities

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your archives through an efficient web interface. A denial of service vulnerability exists in Rdiffweb versions prior to 2.4.8, which stems from a lack of length validation of the...

CVE-2022-3295: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8...

Rdiffweb security vulnerabilities

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. Provides quick access to your archives through an efficient web interface. A denial of service vulnerability exists in Rdiffweb versions prior to 2.4.8, which stems from a lack of length validation of the root...

PT-2022-21604 · Rdiffweb · Rdiffweb

Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.8 Description: The issue concerns the allocation of resources without limits or throttling, which can lead to a denial-of-service DOS attack or memory corruption. Specifically, there is no limit on the length of...

PT-2022-21619 · Rdiffweb · Rdiffweb

Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.8 Description: The issue is related to the allocation of resources without limits or throttling, which can lead to a Denial of Service DoS attack. Specifically, an unlimited length "title" field when adding an S...

CVE-2022-3298: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8...

Rdiffweb security vulnerabilities

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. Provides quick access to your archives through an efficient web interface. A denial of service vulnerability exists in Rdiffweb versions prior to 2.4.8, which stems from the "title" parameter when adding an SSH...

rdiffweb vulnerable to account access via session fixation

rdiffweb prior to 2.4.7 fails to invalidate session cookies on logout, leading to session fixation and allowing an attacker to access a users account. After logging in and logging out, the application continues to use the preauthentication cookies. The cookies remain the same after closing the...

GHSA-J3Q4-GMJ4-MJ95 rdiffweb vulnerable to account access via session fixation

rdiffweb prior to 2.4.7 fails to invalidate session cookies on logout, leading to session fixation and allowing an attacker to access a users account. After logging in and logging out, the application continues to use the preauthentication cookies. The cookies remain the same after closing the...

CVE-2022-3269

Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7...

PYSEC-2022-290

Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7...

PYSEC-2022-290

Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7...

CVE-2022-3269

Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7...

CVE-2022-3269 Session Fixation in ikus060/rdiffweb

Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7...

CVE-2022-3269 Session Fixation in ikus060/rdiffweb

Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7...

CVE-2022-3269

CVE-2022-3269 affects the rdiffweb web application (itas ikus060/rdiffweb) prior to version 2.4.7. The root cause is failure to invalidate session cookies on logout, enabling session fixation where an attacker can reuse a valid cookie to access a user account after login/logout sequences. Impact ...

Cross-Site Request Forgery (CSRF)

rdiffweb is vulnerable to cross-site request forgery. The vulnerability exists because the renderprefspanel function in prefnotification.py does not properly handle the passwordform and profileform attributes, allowing an attacker to change the email ID of the user by redirecting to the malicious...

rdiffweb Cross-Site Request Forgery vulnerability can lead to user email ID being changed

rdiffwen prior to version 2.4.7 is vulnerable to Cross-Site Request Forgery CSRF. An attacker can change a user's email ID. Version 2.4.7 has a fix for this issue...

GHSA-GMJ8-84R4-H46J rdiffweb Cross-Site Request Forgery vulnerability can lead to user email ID being changed

rdiffwen prior to version 2.4.7 is vulnerable to Cross-Site Request Forgery CSRF. An attacker can change a user's email ID. Version 2.4.7 has a fix for this issue...

GHSA-74J6-3HH4-W3F5 rdiffweb Cross-Site Request Forgery vulnerability

rdiffweb prior to 2.4.6 is vulnerable to cross-site request forgery on the repository settings. A malicious user can change the settings of a repository by sending a URL to the victim. This issue is fixed in version 2.4.6...