Vulnerabilities

TI-2014-07294 CVE-2014-8941 · GHSA-h5vw-3fmg-q8v6

Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or…

MEDIUM 44

Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01095 Published 2020-06-01 No fix listed CWE-89

TI-2014-07295 CVE-2014-8942 · GHSA-rfw2-jqgg-8972

Lexiglot through 2014-11-20 allows CSRF.

LOW 39

Lexiglot through 2014-11-20 allows CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00485 Published 2020-06-01 No fix listed CWE-352

TI-2014-07296 CVE-2014-8943 · GHSA-g446-hf9f-gf46

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.

MEDIUM 40

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00958 Published 2020-06-01 No fix listed CWE-918

TI-2014-07297 CVE-2014-8944 · GHSA-w5hh-xqcg-3g7q

Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via…

LOW 25

Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install_name, intro_message, or new_file_content parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2020-06-01 No fix listed CWE-79

TI-2014-07290 CVE-2014-8937 · GHSA-qwm6-w26c-j5xh

Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn…

LOW 35

Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01099 Published 2020-06-01 No fix listed CWE-400

TI-2014-07291 CVE-2014-8938 · GHSA-qw58-58rf-9phv

Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing…

LOW 34

Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00319 Published 2020-06-01 No fix listed CWE-522

TI-2014-07292 CVE-2014-8939 · GHSA-q73q-v9vp-c97v

Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full…

LOW 27

Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.php request if PHP has a non-recommended configuration that produces warn…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01368 Published 2020-06-01 No fix listed CWE-22

TI-2014-07293 CVE-2014-8940 · GHSA-wxj8-6xmx-mcvv

Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information…

LOW 26

Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01113 Published 2020-06-01 No fix listed CWE-200

TI-2014-07298 CVE-2014-8945 · GHSA-2mmf-g2rw-rchg

admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields.

MEDIUM 47

admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02441 Published 2020-06-01 No fix listed CWE-78

Vulnerabilities

Filters