Zendto@4.07-1 Security Vulnerabilities and Issues — Zendto@4.07-1 CVE List

Lucene search

ZendZendto4.07-1

4 matches found

CVE•added 2020/03/24 9:15 p.m.•45 views

CVE-2020-8986

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.

9.8CVSS9.4AI score0.00919EPSS

CVE•added 2020/03/24 9:15 p.m.•38 views

CVE-2020-8984

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.

7.5CVSS7.4AI score0.00201EPSS

CVE•added 2020/03/24 9:15 p.m.•32 views

CVE-2020-8985

ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.

8.8CVSS8.3AI score0.00272EPSS

CVE•added 2013/12/28 4:53 a.m.•28 views

CVE-2013-6808

Cross-site scripting (XSS) vulnerability in lib/NSSDropoff.php in ZendTo before 4.11-13 allows remote attackers to inject arbitrary web script or HTML via a modified emailAddr field to pickup.php.

4.3CVSS5.8AI score0.00232EPSS