Lucene search

K

Froxlor Security Vulnerabilities

cve
cve

CVE-2024-34070

Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on.....

9.6CVSS

5.6AI Score

0.0004EPSS

2024-05-14 03:38 PM
50
cve
cve

CVE-2023-6069

Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to...

9.9CVSS

8.7AI Score

0.001EPSS

2023-11-10 01:15 AM
39
cve
cve

CVE-2023-50256

Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements.....

7.5CVSS

7.4AI Score

0.001EPSS

2024-01-03 11:15 PM
13
cve
cve

CVE-2023-0565

Business Logic Errors in GitHub repository froxlor/froxlor prior to...

5.5CVSS

5AI Score

0.001EPSS

2023-01-29 10:15 PM
36
cve
cve

CVE-2023-4304

Business Logic Errors in GitHub repository froxlor/froxlor prior to...

3.8CVSS

3.7AI Score

0.0004EPSS

2023-08-11 01:15 AM
19
cve
cve

CVE-2023-0572

Unchecked Error Condition in GitHub repository froxlor/froxlor prior to...

5.3CVSS

5.1AI Score

0.001EPSS

2023-01-29 11:15 PM
46
cve
cve

CVE-2023-0564

Weak Password Requirements in GitHub repository froxlor/froxlor prior to...

7.5CVSS

7.5AI Score

0.001EPSS

2023-01-29 01:15 AM
57
cve
cve

CVE-2023-0566

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to...

6.2CVSS

4.9AI Score

0.001EPSS

2023-01-29 10:15 PM
36
cve
cve

CVE-2023-4829

Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to...

5.4CVSS

4.7AI Score

0.0004EPSS

2023-10-13 01:15 PM
54
cve
cve

CVE-2023-5564

Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to...

4.8CVSS

4.8AI Score

0.0004EPSS

2023-10-13 01:15 AM
27
cve
cve

CVE-2022-4864

Argument Injection in GitHub repository froxlor/froxlor prior to...

5.4CVSS

5.6AI Score

0.001EPSS

2022-12-30 11:15 PM
50
cve
cve

CVE-2023-3668

Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to...

7.2CVSS

7.1AI Score

0.001EPSS

2023-07-14 01:15 AM
15
cve
cve

CVE-2023-3192

Session Fixation in GitHub repository froxlor/froxlor prior to...

5.4CVSS

4.8AI Score

0.001EPSS

2023-06-11 11:15 AM
17
cve
cve

CVE-2023-3173

Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to...

9.8CVSS

9.5AI Score

0.002EPSS

2023-06-09 02:15 AM
117
cve
cve

CVE-2023-3172

Path Traversal in GitHub repository froxlor/froxlor prior to...

7.2CVSS

6.6AI Score

0.001EPSS

2023-06-09 01:15 AM
102
cve
cve

CVE-2023-2666

Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to...

7.5CVSS

6.9AI Score

0.001EPSS

2023-05-12 01:15 AM
17
cve
cve

CVE-2023-2034

Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to...

8.8CVSS

8.7AI Score

0.001EPSS

2023-04-14 01:15 AM
24
cve
cve

CVE-2023-0315

Command Injection in GitHub repository froxlor/froxlor prior to...

8.8CVSS

7.8AI Score

0.54EPSS

2023-01-16 01:15 AM
60
cve
cve

CVE-2023-1307

Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to...

9.8CVSS

9.5AI Score

0.002EPSS

2023-03-10 01:15 AM
37
cve
cve

CVE-2023-1033

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to...

8.8CVSS

7.2AI Score

0.001EPSS

2023-02-25 01:15 AM
31
cve
cve

CVE-2023-0877

Code Injection in GitHub repository froxlor/froxlor prior to...

8.8CVSS

9.2AI Score

0.001EPSS

2023-02-17 01:15 AM
24
cve
cve

CVE-2023-0671

Code Injection in GitHub repository froxlor/froxlor prior to...

8.8CVSS

9.4AI Score

0.001EPSS

2023-02-04 01:15 AM
29
cve
cve

CVE-2023-0316

Path Traversal: '..\filename' in GitHub repository froxlor/froxlor prior to...

5.5CVSS

5.8AI Score

0.0004EPSS

2023-01-16 01:15 AM
37
cve
cve

CVE-2022-4868

Improper Authorization in GitHub repository froxlor/froxlor prior to...

4.3CVSS

4.6AI Score

0.001EPSS

2022-12-31 10:15 AM
30
cve
cve

CVE-2022-4867

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to...

4.3CVSS

4.6AI Score

0.001EPSS

2022-12-31 09:15 AM
34
cve
cve

CVE-2022-3869

Code Injection in GitHub repository froxlor/froxlor prior to...

6.1CVSS

6.4AI Score

0.001EPSS

2022-11-05 02:15 PM
47
5
cve
cve

CVE-2022-3721

Code Injection in GitHub repository froxlor/froxlor prior to...

4.6CVSS

4.9AI Score

0.001EPSS

2022-11-04 01:15 PM
38
4
cve
cve

CVE-2018-12642

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current...

7.5CVSS

7.6AI Score

0.002EPSS

2022-10-03 04:22 PM
19
cve
cve

CVE-2022-3017

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to...

6.5CVSS

6.5AI Score

0.001EPSS

2022-08-28 02:15 PM
36
4
cve
cve

CVE-2020-29653

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML...

6.1CVSS

6.4AI Score

0.001EPSS

2022-04-13 01:15 PM
45
cve
cve

CVE-2020-28957

Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input...

5.4CVSS

5.4AI Score

0.001EPSS

2021-10-22 08:15 PM
25
cve
cve

CVE-2021-42325

Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB...

9.8CVSS

9.6AI Score

0.006EPSS

2021-10-12 08:15 PM
59
cve
cve

CVE-2020-10236

An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of _createUserdataConf in...

6.1CVSS

5.9AI Score

0.0004EPSS

2020-03-09 04:15 PM
38
cve
cve

CVE-2020-10235

An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in...

8.8CVSS

8.8AI Score

0.005EPSS

2020-03-09 04:15 PM
22
cve
cve

CVE-2020-10237

An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time,...

5.5CVSS

5.1AI Score

0.0004EPSS

2020-03-09 04:15 PM
22
cve
cve

CVE-2018-1000527

Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST['ssl_ipandport']. This vulnerability...

7.2CVSS

7.5AI Score

0.003EPSS

2018-06-26 04:29 PM
18
cve
cve

CVE-2015-5959

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading...

9.8CVSS

9.4AI Score

0.007EPSS

2017-09-06 09:29 PM
20
cve
cve

CVE-2016-5100

Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a...

9.8CVSS

9.4AI Score

0.004EPSS

2017-02-13 06:59 PM
106
4