GHSA-7Q4R-X5QG-MMCP rdiffweb has no rate limit on resend email feature

rdiffweb prior to 2.5.5 has no rate limit on the "resend email feature" while enable or disable 2FA from /prefs/mfa endpoint...

rdiffweb vulnerable to Special Element Injection

In rdiffweb prior to 2.5.5, lack of sanitisation of characters in SSH key name could allow attacker to inject a hyperlink injection that could allow attacker to redirect victim to malicious websites...

CVE-2022-4719

Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5...

CVE-2022-4723

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5...

CVE-2022-4720

Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5...

CVE-2022-4722

Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5...

PYSEC-2022-43008

Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5...

PYSEC-2022-43010

Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5...

PYSEC-2022-43008

Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5...

PYSEC-2022-43005

Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5...

PYSEC-2022-43006

Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5...

PYSEC-2022-43009

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5...

PYSEC-2022-43007

Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository ikus060/rdiffweb prior to 2.5.5...

Open redirect

Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5...

Design/Logic Flaw

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5...

PYSEC-2022-43009

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5...

PYSEC-2022-43005

Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5...

Cross Site Request Forgery (CSRF)

rdiffweb is vulnerable to cross site request forgery. The vulnerability exists in run function of authform.py due to lack of validation of session management which allows an attacker to gain access to sensitive information in the system...

Open Redirect

rdiffweb is vulnerable to open redirect. The vulnerability exists in rdwapp.py due to improper validation of the header value which allows an attacker to redirect the user to supply invalid input...

Rdiffweb 输入验证错误漏洞

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your archives through an efficient web interface. An input validation error vulnerability exists in Rdiffweb versions prior to 2.5.5, which originates from a hyperlink injection via a...