673 matches found
SUSE CVE-2020-10236
An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of createUserdataConf in...
SUSE CVE-2020-10235
An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of backupExistingDatabase in install/lib/class.FroxlorInstall.php...
SUSE CVE-2020-10237
An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time,...
SUSE CVE-2020-29653
Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags...
SUSE CVE-2021-42325
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name...
SUSE CVE-2022-3017
Cross-Site Request Forgery CSRF in GitHub repository froxlor/froxlor prior to 0.10.38...
SUSE CVE-2023-0315
Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8...
SUSE CVE-2023-0316
Path Traversal: '..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0...
SUSE CVE-2023-0564
Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10...
SUSE CVE-2023-0565
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10...
SUSE CVE-2023-0566
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in froxlor/froxlor prior to 2.0.10...
SUSE CVE-2023-0572
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10...
SUSE CVE-2023-0671
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10...
Privilege Escalation
froxlor/froxlor is vulnerable to Privilege Escalation. The vulnerability exists due to improper validation of user uploaded files, which allows an attacker to inject and execute malicious code into the system, resulting in privilege escalation...
HTML Injection
froxlor/froxlor is vulnerable to HTML Injection. The vulnerability is due to the Interval Time in the Dropdown Menu of the cronjob page, which doesn't validate the input, allowing an attacker to change to time to a stored HTML Injection due to the update function in Cronjobs.php...
Weak Password Requirements
froxlor/froxlor is vulnerable to Weak Password Requirements. The vulnerability exists in add and update functions of DirProtections.php, which allows users to create weak passwords resulting in account takeovers via bruteforce attacks...
Information Disclosure
froxlor/froxlor is vulnerable to Information Disclosure. A remote attacker is able to gain access to unauthorized user data via a failed prepared SQL query due to an unchecked error condition, resulting in the disclosure of sensitive information...
SQL Injection
froxlor/froxlor is vulnerable to SQL Injection. The vulnerability exists in the Database parameter in errorreport.php due to improperly validated parameters, allowing a remote attacker to inject arbitrary SQL commands...
