Vulnerabilities

TI-2008-03559 CVE-2008-3717 · GHSA-cfhf-797j-qrrq

Harmoni before 1.6.0 does not require administrative privileges to list (1) user names or…

LOW 25

Harmoni before 1.6.0 does not require administrative privileges to list (1) user names or (2) asset ids, which allows remote attackers to obtain sensitive information.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01256 Published 2008-08-19 No fix listed CWE-264

TI-2008-03558 CVE-2008-3716 · GHSA-88jr-vwr6-7xqw

Cross-site request forgery (CSRF) vulnerability in Harmoni before 1.6.0 allows remote…

LOW 28

Cross-site request forgery (CSRF) vulnerability in Harmoni before 1.6.0 allows remote attackers to make administrative modifications via a (1) save or (2) delete action to an unspecified component.

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.00559 Published 2008-08-19 No fix listed CWE-352

TI-2008-03443 CVE-2008-3596 · GHSA-vmrv-vjrp-6298

Cross-site scripting (XSS) vulnerability in Harmoni before 1.4.7 allows remote attackers…

LOW 22

Cross-site scripting (XSS) vulnerability in Harmoni before 1.4.7 allows remote attackers to inject arbitrary web script or HTML via the Username field, which is inserted into logs that could be rendered when viewed by an…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01073 Published 2008-08-12 No fix listed CWE-79

Vulnerabilities

Filters

Harmoni before 1.6.0 does not require administrative privileges to list (1) user names or…

Cross-site request forgery (CSRF) vulnerability in Harmoni before 1.6.0 allows remote…

Cross-site scripting (XSS) vulnerability in Harmoni before 1.4.7 allows remote attackers…