CVE-2021-21376

CVE-2021-21376 affects OMERO.web (Django-based web interface for OMERO). The vulnerability arises because before version 5.9.0, the main webclient pages load and expose various information about the current user (e.g., user id, name, and group memberships). Some additional loaded information is n...

CVE-2021-21377

Summary: CVE-2021-21377 affects OMERO.web up to version 5.9.0, where redirects after login or group context switch could be sent to untrusted external URLs due to missing URL validation. The vulnerability is mitigated in 5.9.0 by added URL validation; external URLs are rejected unless explicitly ...

CVE-2020-7932

CVE-2020-7932 affects OMERO.web prior to 5.6.3. The issue allows sensitive data elements (e.g., a session key) to be passed in URL query parameters. If a user is lured into clicking a malicious link, these parameters can be exposed in the Referer header seen by the target, and information in the ...