CVE-2020-12850

The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF such as version 2.0.3 have a looser policy restriction allowing the “pydio” user to execute any privileged command using sudo. In version 2.0.4 of the...

Design/Logic Flaw

The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF such as version 2.0.3 have a looser policy restriction allowing the “pydio” user to execute any privileged command using sudo. In version 2.0.4 of the...

CVE-2020-12850

Affected product: Pydio Cells Enterprise OVF 2.0.4 (and related 2.0.x releases). The Red Hat/ENISA and CoreLabs advisories describe a set of vulnerabilities in the Pydio Cells 2.0.4 appliance that enable remote code execution, privilege escalation, and arbitrary file operations through multiple v...

CVE-2020-12850

The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF such as version 2.0.3 have a looser policy restriction allowing the “pydio” user to execute any privileged command using sudo. In version 2.0.4 of the...

Abstrium Pydio Cells Cross-Site Scripting Vulnerability (CNVD-2020-33352)

Abstrium Pydio Cells is a next-generation file-sharing platform developed in the Go language by Abstrium France. A security vulnerability exists in Abstrium Pydio Cells version 2.0.4. The vulnerability can be exploited by an attacker to access other users' personal photos via a build URL...

Unspecified Vulnerability in Abstrium Pydio Cells

Abstrium Pydio Cells is a next-generation file-sharing platform developed in the Go language by Abstrium France. A security vulnerability exists in Abstrium Pydio Cells version 2.0.4. The vulnerability can be exploited by an attacker to obtain the associated hidden account username and password,...

CVE-2020-12849

Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user...

CVE-2020-12849

Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user...

CVE-2020-12848

In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password a...

CVE-2020-12848

In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password a...

Design/Logic Flaw

In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password a...

Design/Logic Flaw

Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user...

CVE-2020-12848

In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password a...

CVE-2020-12848

CVE-2020-12848 (Pydio Cells 2.0.4) permits an authenticated user who shares a file via a public link to create a hidden backend account with a random username. An attacker with access to the public link can obtain the hidden username/password and log in, gaining actions not available to public sh...

CVE-2020-12849

Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user...

CVE-2020-12849

CVE-2020-12849 affects Pydio Cells 2.0.4. The vulnerability is a Stored Cross-Site Scripting (XSS) in profile pictures: any user can upload a profile image (including SVGs with embedded JavaScript) that can be accessed via a direct URL by any user (authenticated or not). Exploitation can trigger ...

Abstrium Pydio Cells Input Validation Error Vulnerability

Abstrium Pydio Cells is a next-generation file-sharing platform developed in the Go language by Abstrium France. A security vulnerability exists in an updated feature in Abstrium Pydio Cells version 2.0.4. An attacker could exploit the vulnerability to execute code with the privileges of the user...

Abstrium Pydio Cells Information Disclosure Vulnerability

Abstrium Pydio Cells is a next-generation file-sharing platform developed in the Go language by Abstrium France. A security vulnerability exists in Abstrium Pydio Cells version 2.0.4, which can be exploited by attackers to obtain sensitive information...

Abstrium Pydio Cells Input Validation Error Vulnerability (CNVD-2020-33353)

Abstrium Pydio Cells is a next-generation file-sharing platform developed in the Go language by Abstrium France. A security vulnerability exists in Abstrium Pydio Cells version 2.0.4. The vulnerability can be exploited to allow an attacker to execute arbitrary binaries...

Abstrium Pydio Cells Cross-Site Scripting Vulnerability

Abstrium Pydio Cells is a next-generation file-sharing platform developed in the Go language by Abstrium France. A cross-site scripting vulnerability exists in Abstrium Pydio Cells version 2.0.4. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. ...