Read the docs

indico

Records29All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

indico records in CISA KEV

No indico vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Records

29 records

TI-2024-34052 CVE-2024-50633 · GHSA-3wg7-r7q5-r2jf

Authorization bypass in Indico

Priority HIGH 72

A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00635 Published 2025-01-16 Fixed in 3.3.3 CWE-201
Priority HIGH 68

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0031 Published 2026-02-25 Fixed in 35.8.3, 38.5.4 +1 CWE-1004
Priority MEDIUM 63

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00375 Published 2026-02-25 Fixed in 35.8.3, 38.5.4 +1 CWE-204
Priority MEDIUM 62

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00338 Published 2026-02-25 Fixed in 35.8.3, 38.5.4 +1 CWE-1004
Priority MEDIUM 50

White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application (the default installation makes the webserver run as the root user)…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00712 Published 2023-04-24 No fix listed CWE-20
Priority MEDIUM 50

Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0075 Published 2023-04-24 No fix listed CWE-200
Priority MEDIUM 42

A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids/<scope>/dids/searc…

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00281 Published 2026-05-06 Fixed in 35.8.5, 38.5.5 +2 CWE-89
Priority LOW 35

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00299 Published 2026-02-27 Fixed in 3.3.11 CWE-306
Priority LOW 30

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00339 Published 2026-10-08 Fixed in 3.3.13 CWE-918
Priority LOW 27

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00383 Published 2024-09-04 Fixed in 3.3.4 CWE-1395
Priority LOW 25

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00662 Published 2025-07-14 Fixed in 3.3.7 CWE-200
Priority LOW 25

Indico is an open source a general-purpose, web based event management tool.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00516 Published 2023-07-21 Fixed in 3.2.6 CWE-79
TI-2026-69690 CVE-2026-107396 · GHSA-c4wc-ggrj-jg9v

Cross-site scripting in Indico link fields

Priority LOW 24

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00195 Published 2026-10-08 Fixed in 3.3.13 CWE-692
Priority LOW 24

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00193 Published 2026-02-19 Fixed in 3.3.10 CWE-79
Priority LOW 24

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00206 Published 2025-09-10 Fixed in 3.3.8 CWE-79
Load more
Open these records in search →