593 matches found
Rdiffweb 安全漏洞
Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. Provides quick access to your archives through an efficient web interface. A security vulnerability exists in Rdiffweb versions prior to 2.4.1, which stems from improper restriction of rendered UI layers or fram...
Open Redirect in ikus060/rdiffweb
Description The application has an Open Redirect vulnerability because the data filtering process does not completely prevent attacks. Proof of Concept - Step 1: Visit https://rdiffweb-demo.ikus-soft.com/login/?redirect=//evil.com - Step 2: Login with valid account, you will be redirect to evil.c...
Open Redirect in ikus060/rdiffweb
Description ikus060/rdiffweb is vulnerable to open redirect at login page. Proof of Concept https://rdiffweb-demo.ikus-soft.com/login/?redirect=https://attacker.com after login to the above url it redirect to attacker .com Impact This vulnerability is capable of redirecting to malicious website...
Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb
✍️ Description Hello dear Rdiffweb team. I found a CSRF vulnerability on following endpoint that attackers able to change the email of a user with PoC.html 🕵️♂️ Proof of Concept 1. user with right privileges should be logged in Firefox or Safari. 2. Users go to a website that contain PoC.html...
Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb
✍️ Description Hello dear Rdiffweb team. I found a CSRF vulnerability on following endpoint that attackers able to Delete repositories History with PoC.html 🕵️♂️ Proof of Concept 1. user with right privileges should be logged in Firefox or Safari. 2. Users go to a website that contain PoC.html...
Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb
✍️ Description Hello dear Rdiffweb team. I found a CSRF vulnerability on following endpoint that attackers able to Create users with PoC.html 🕵️♂️ Proof of Concept 1. User with right privileges should be logged in Firefox or Safari. 2. Users go to a website that contain PoC.html 3.after visiting...
Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb
✍️ Description Hello dear Rdiffweb team. I found a CSRF vulnerability on following endpoint that attackers able to Delete users with PoC.html 🕵️♂️ Proof of Concept 1. user with right privileges should be logged in Firefox or Safari. 2. Users go to a website that contain PoC.html 3.after visiting...
rdiffweb 0.3.5 - Directory Traversal vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/24092/info rdiffWeb is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable...
rdiffweb 0.3.5 - Directory Traversal
rdiffweb 0.3.5 - Directory Traversal source: https://www.securityfocus.com/bid/24092/info rdiffWeb is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable...
rdiffweb 0.3.5 - Directory Traversal
source: https://www.securityfocus.com/bid/24092/info rdiffWeb is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserve...
CVE-2007-2747
Directory traversal vulnerability in rdwhelpers.py in rdiffWeb before 0.3.5.1 allows remote attackers to read arbitrary files via a .. dot dot in the path parameter to the /browse URI...
CVE-2007-2747
CVE-2007-2747 : A directory traversal vulnerability in rdifWeb’s rdw_helpers.py (rdiffWeb) before version 0.3.5.1 allows remote attackers to read arbitrary files by supplying a .. (dot dot) path in the /browse URI. The underlying flaw is a lack of proper path sanitization, enabling traversal beyo...
CVE-2007-2747: Undefined Security Weakness
Directory traversal vulnerability in rdwhelpers.py in rdiffWeb before 0.3.5.1 allows remote attackers to read arbitrary files via a .. dot dot in the path parameter to the /browse URI...