CVE-2021-29024

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication...

Directory traversal

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication...

Design/Logic Flaw

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable...

CVE-2021-29024

CVE-2021-29024 affects InvoicePlane 1.5.11, where a misconfigured web server enables unauthenticated directory listing and file download, effectively allowing directory traversal to private files. The root cause is misconfiguration that permits access to sensitive directories/files without authen...

InvoicePlane 路径遍历漏洞

InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a path traversal vulnerability that originates from a misconfigured web server that allows unauthenticated...

CVE-2021-29023

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable...

PT-2021-18027 · Unknown · Invoiceplane

Name of the Vulnerable Software and Affected Versions: InvoicePlane version 1.5.11 Description: The issue concerns a lack of rate-limiting for password reset and the use of a weak mechanism to generate reset tokens, making them predictable. Recommendations: For InvoicePlane version 1.5.11, consid...

PT-2021-18028 · Unknown · Invoiceplane

Name of the Vulnerable Software and Affected Versions: InvoicePlane version 1.5.11 Description: The issue allows unauthenticated directory listing and file download due to a misconfigured web server. This enables an attacker to perform directory traversal and download files that are supposed to b...

CVE-2021-29024

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication...

InvoicePlane 安全漏洞

InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a security vulnerability that stems from the absence of any rate limitation on password resets, where reset...

CVE-2021-29023

InvoicePlane 1.5.11 is affected by a vulnerability where there is no rate limiting for password resets and the reset token is generated by a weak, predictable mechanism. Affected component is the password reset flow within InvoicePlane; root cause is lack of rate-limiting and weak token generatio...

CVE-2021-29022

In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...

CVE-2021-29022

In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...

Design/Logic Flaw

In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...

CVE-2021-29022

In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...

CVE-2021-29022

InvoicePlane 1.5.11 is affected by CVE-2021-29022, where the upload feature discloses the full path of the file upload directory. Affected component: the upload handling mechanism in InvoicePlane; root cause indicated by public records as a path disclosure. Impact is limited to confidentiality (p...

InvoicePlane 代码问题漏洞

InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. A code issue vulnerability exists in InvoicePlane version 1.5.11. The vulnerability allows an attacker to obtain the full path to the file upload...

CVE-2019-7223

InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...

CVE-2019-7223

InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...

Cross site scripting

InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...