Vendors / Open-audit Records 6 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 1
Exploited now Open-audit records in CISA KEV No Open-audit vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 41
Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI.
CVSS 3.0 HIGH 8.8· Network · No auth · User interaction · EPSS 0.01241 · Published 2018-03-25 · No fix listed CWE-352
Priority LOW 35
Open-AudIT before 2.2 has CSV Injection.
CVSS 3.0 MEDIUM 6.8· Network · Low privileges · User interaction · EPSS 0.02687 · Published 2018-04-19 · No fix listed CWE-1236
Priority LOW 28
An issue was discovered in Open-AudIT Professional 2.1.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00675 · Published 2018-03-26 · No fix listed CWE-601
Priority LOW 28
Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
CVSS 3.0 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01554 · Published 2018-03-22 · No fix listed CWE-79
Priority LOW 27
Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the Admin->Logs section (with…
CVSS 3.0 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01115 · Published 2018-04-12 · No fix listed CWE-79
Priority LOW 25
Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI.
CVSS 3.0 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00526 · Published 2018-03-25 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
0 1 5 0 0
THREATIST.IORead the docs