38 matches found
Information Exposure
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Information Exposure via the Domains::get, Domains::listing, SubDomains::get, and SubDomains::listing API functions. An attacker can access DKIM private signing keys belonging to othe...
Insufficient Session Expiration
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Insufficient Session Expiration due to failure to invalidate existing session, API keys, and 2FA trust cookies when a user password is changed. An attacker can maintain unauthorized...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through a race condition in the SshKeys::generateFiles process. An attacker can gain unauthorized root access by atomically replacing...
Information Exposure
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Information Exposure via the Certificates.get and Certificates.listing API commands, which return the sslkeyfile field containing raw PEM TLS private-key content in JSON responses. An...
Arbitrary Argument Injection
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Arbitrary Argument Injection through the letsencryptchallengepath setting, which is not properly restricted or escaped. An attacker can achieve arbitrary command execution as root by...
Cross-site Request Forgery (CSRF)
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the 2fa management process. An attacker can disable two-factor authentication for a logged-in user by enticing them to follow a crafted link,...
Information Exposure
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Information Exposure via the DirProtections.listing API command, which returns bcrypt password hashes for protected-directory users. An attacker can obtain sensitive credential...
CRLF Injection
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to CRLF Injection in the validateUrl process. An attacker can inject arbitrary web-server configuration lines by supplying a crafted subdomain redirect URL containing carriage return and...
Symlink Attack
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Symlink Attack via the DataDump cron process due to insufficient validation of intermediate path components in the export destination. An attacker can gain unauthorized ownership of...
Incorrect Default Permissions
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Incorrect Default Permissions in the EmailSender.add API command when the mail.allowexternaldomains policy is not enforced. An attacker can register arbitrary external sender addresse...
Symlink Attack
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Symlink Attack via the deleteFtpData cron task. An attacker can cause arbitrary directory trees to be recursively deleted by planting a symlink in the FTP home directory between task...
CVE-2023-2034
Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14...
CVE-2023-6069
Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0...
CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor
Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0...
CVE-2023-5564 Cross-site Scripting (XSS) - Stored in froxlor/froxlor
Cross-site Scripting XSS - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1...
CVE-2023-3668 Improper Encoding or Escaping of Output in froxlor/froxlor
Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21...
CVE-2023-3173
Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20...
CVE-2023-3172 Path Traversal in froxlor/froxlor
Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20...
