Allen Disk Project

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Allen Disk Project records in CISA KEV

No Allen Disk Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Allen Disk 6 records LOW

Records

6 records in Allen Disk · all components

TI-2017-06546 CVE-2017-9091 · GHSA-44m6-j5rj-h6pv

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])…

LOW 35

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code']) == 1, which leads to CAPTCHA bypass by emptying $_POST['captcha'].

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01306 Published 2017-05-19 No fix listed CWE-20

TI-2017-06545 CVE-2017-9090 · GHSA-fhph-5g4h-87mq

reg.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])==1, which…

LOW 35

reg.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])==1, which makes it possible to bypass the CAPTCHA via an empty $_POST['captcha'].

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01306 Published 2017-05-19 No fix listed CWE-20

TI-2017-06745 CVE-2017-9307 · GHSA-fwcr-p45j-g3cw

SSRF vulnerability in remotedownload.php in Allen Disk 1.6 allows remote authenticated…

LOW 31

SSRF vulnerability in remotedownload.php in Allen Disk 1.6 allows remote authenticated users to conduct port scans and access intranet servers via a crafted file parameter.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00894 Published 2017-05-31 No fix listed CWE-918

TI-2017-06356 CVE-2017-8848 · GHSA-f8qx-xf75-phhp

Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password.

LOW 29

Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00487 Published 2017-05-08 No fix listed CWE-352

TI-2017-06340 CVE-2017-8832 · GHSA-w86c-fh37-jvpq

Allen Disk 1.6 has XSS in the id parameter to downfile.php.

LOW 28

Allen Disk 1.6 has XSS in the id parameter to downfile.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00631 Published 2017-05-08 No fix listed CWE-79

TI-2017-06691 CVE-2017-9249 · GHSA-669w-jhfq-mj6p

Cross-site scripting (XSS) vulnerability in Allen Disk 1.6 allows remote authenticated…

LOW 26

Cross-site scripting (XSS) vulnerability in Allen Disk 1.6 allows remote authenticated users to inject arbitrary web script or HTML persistently by uploading a crafted HTML file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0068 Published 2017-05-28 No fix listed CWE-79

Open these records in search →

Critical	0
High	2
Medium	4
Low	0
No CVSS	0