CVE-2018-1000551

Trovebox version = 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can result in Authentication bypass. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 742b8edbe...

CVE-2018-1000554

Trovebox version = 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that can result in Password reset. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed...

CVE-2018-1000553

CVE-2018-1000553 concerns Trovebox ≤ 4.0.0-rc6, where the webhook component is vulnerable to Server-Side Request Forgery (SSRF). The flaw allows reading or updating internal resources and is exploitable via HTTP requests. The issue is tied to the webhook’s handling of internal requests, with the ...

CVE-2018-1000553

Trovebox version = 4.0.0-rc6 contains a Server-Side request forgery vulnerability in webhook component that can result in read or update internal resources. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed...

CVE-2018-1000551

Trovebox up to version 4.0.0-rc6 is affected by a PHP type juggling flaw in the album view component that can bypass authentication. Exploitation is reported to be viable via an HTTP request. The issue’s root cause is a PHP type juggling vulnerability in the album view component, allowing bypass ...

CVE-2018-1000553

Trovebox version = 4.0.0-rc6 contains a Server-Side request forgery vulnerability in webhook component that can result in read or update internal resources. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed...

CVE-2018-1000551

Trovebox version = 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can result in Authentication bypass. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 742b8edbe...

CVE-2018-1000554

CVE-2018-1000554 affects Trovebox before or equal to 4.0.0-rc6, where the password-reset token generation in the user component is insecure. An attacker could exploit this flaw by sending an HTTP request to trigger a password reset, potentially compromising accounts. The issue is described as a t...

CVE-2018-1000552

Summary: CVE-2018-1000552 affects Trovebox ≤ 4.0.0-rc6, with a SQL injection in the album component. The vulnerability allows SQL code injection via HTTP requests and has a high impact (CVSS v3 base score 8.8). The issue is attributed to the album component in Trovebox and is tracked across multi...

CVE-2018-1000552

Trovebox version = 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed...

CVE-2018-1000552

Trovebox version = 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed...

CVE-2018-1000553: Server-Side Request Forgery (SSRF)

Trovebox version = 4.0.0-rc6 contains a Server-Side request forgery vulnerability in webhook component that can result in read or update internal resources. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed...

PT-2018-9448

Name of the Vulnerable Software and Affected Versions Trovebox versions prior to 4.0.0-rc6 after commit 742b8ed contains the fix, implying versions up to 4.0.0-rc6 are affected Description The issue is related to a Server-Side request forgery vulnerability in the webhook component. This can lead ...

PT-2018-9449

Name of the Vulnerable Software and Affected Versions Trovebox versions prior to 4.0.0-rc6 Description The issue is related to an unsafe password reset token generation in the user component, which can lead to password reset. This can be exploited via an HTTP request. Recommendations For versions...

CVE-2018-1000554: Weak Password Recovery Mechanism for Forgotten Password

Trovebox version = 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that can result in Password reset. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed...

CVE-2018-1000551: Undefined Security Weakness

Trovebox version = 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can result in Authentication bypass. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 742b8edbe...

PT-2018-9446

Name of the Vulnerable Software and Affected Versions Trovebox versions prior to 4.0.0-rc6 after commit 742b8edbe contains the fix Description The issue is related to a PHP Type juggling vulnerability in the album view component, which can lead to authentication bypass. This can be exploited via ...

CVE-2018-1000552: Improper Neutralization of Special Elements used in an SQL Command

Trovebox version = 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed...

PT-2018-9447

Name of the Vulnerable Software and Affected Versions Trovebox versions prior to 4.0.0-rc6 after commit 742b8ed contains the fix, implying versions before this commit are affected Description The issue is related to a SQL Injection vulnerability in the album component, which can lead to SQL code...

Trovebox Insecure Password Reset Token Generation Vulnerability

Trovebox is an open source image sharing and management platform. user is one of the user components. A security vulnerability exists in the user component of Trovebox prior to version 4.0.0-rc6, which stems from the program failing to create a secure password reset token. An attacker can exploit...