TI-2024-18704 CVE-2024-28125 · GHSA-x9r9-48rm-4xm6
OS command injection in unclebob FitNesse
Priority MEDIUM 51
FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.
unclebob
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
unclebob records in CISA KEVNo unclebob vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2024-18633 CVE-2024-28039 · GHSA-rcfj-pc73-hqv6
XML external entity injection in unclebob FitNesse
Priority LOW 35
Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain sensitive information, alter data, or cause a denial-of-servi…
TI-2024-28466 CVE-2024-42499 · GHSA-q297-5ff8-hc92
Path traversal in unclebob FitNesse
Priority LOW 31
Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026.
TI-2024-26540 CVE-2024-39610 · GHSA-pg82-9w35-3w3r
Cross-site scripting in unclebob FitNesse
Priority LOW 28
Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026.
TI-2024-18707 CVE-2024-28128 · GHSA-mjq8-gg9x-87gr
Cross-site scripting in unclebob FitNesse
Priority LOW 28
Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product a…
TI-2024-15626 CVE-2024-23604 · GHSA-8xjc-25qh-f5x2
Cross-site scripting in unclebob FitNesse
Priority LOW 28
Cross-site scripting vulnerability exists in FitNesse all releases, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a…