Freetakserver-ui Project

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Freetakserver-ui Project records in CISA KEV

No Freetakserver-ui Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Freetakserver-ui 6 records MEDIUM

Records

6 records

TI-2022-09143 CVE-2022-25510 · GHSA-f897-875p-23x7

FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to…

MEDIUM 40

FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01051 Published 2022-03-10 Fixed in 1.9.8.5 CWE-798

TI-2022-09145 CVE-2022-25512 · GHSA-9988-f88m-mr42

FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.

LOW 35

FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01099 Published 2022-03-10 No fix listed CWE-200

TI-2022-09142 CVE-2022-25508 · GHSA-hggv-mcp4-vxc5

An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8…

LOW 35

An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsaf…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01064 Published 2022-03-10 Fixed in 1.9.8.5 CWE-306

TI-2022-09144 CVE-2022-25511 · GHSA-7cr9-rmqr-fpqp

An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI…

LOW 30

An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00737 Published 2022-03-10 No fix listed CWE-22

TI-2022-09140 CVE-2022-25506 · GHSA-jr2m-29wj-w9qc

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.

LOW 30

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00876 Published 2022-03-10 No fix listed CWE-89

TI-2022-09141 CVE-2022-25507 · GHSA-gjh6-wvhq-h4qx

FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS)…

LOW 25

FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00491 Published 2022-03-10 No fix listed CWE-79

Open these records in search →

Critical	0
High	3
Medium	3
Low	0
No CVSS	0