Vendors / GMOD Records 6 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 3
CVSS high 1
Exploited now GMOD records in CISA KEV No GMOD vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 51
GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0111 · Published 2023-07-25 · No fix listed CWE-434
Priority MEDIUM 49
Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00565 · Published 2025-03-05 · Fixed in 2.8.0 CWE-306
Priority MEDIUM 49
When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00661 · Published 2025-03-04 · Fixed in 2.8.0 CWE-23
Priority LOW 36
After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosure
CVSS 4.0 MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00309 · Published 2025-03-05 · Fixed in 2.8.0 CWE-209
Priority LOW 31
GMOD Apollo does not have sufficient logical or access checks when updating a user's information.
CVSS 4.0 HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00277 · Published 2025-03-04 · Fixed in 2.8.0 CWE-266
Priority LOW 22
Cross-site scripting (XSS) vulnerability in GMOD GBrowse before 1.69 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS 2.0 MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01065 · Published 2008-08-26 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
3 1 2 0 0
THREATIST.IORead the docs