Vulnerabilities

Filters

2 selected

14 records

Sort

Vendor: Opencrx Component: Opencrx Clear all filters

TI-2023-11945 CVE-2023-27150 · GHSA-8wjx-p2f8-5rjp

openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via…

MEDIUM 58

openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00397 Published 2023-12-26 No fix listed CWE-79

TI-2023-11946 CVE-2023-27151 · GHSA-f8vf-5cvf-jr22

openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search…

MEDIUM 60

openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number (in the Saved Search Activity) via the Name, Description, or Activity Number field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00454 Published 2023-12-25 No fix listed CWE-79

TI-2023-21563 CVE-2023-40817 · GHSA-96q4-7fwr-gmxh

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field.

MEDIUM 60

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00463 Published 2023-11-18 No fix listed CWE-79

TI-2023-21562 CVE-2023-40816 · GHSA-qjmx-q5m4-xqf5

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.

MEDIUM 60

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00463 Published 2023-11-18 No fix listed CWE-79

TI-2023-21561 CVE-2023-40815 · GHSA-hhcf-79pm-r8r9

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.

MEDIUM 60

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00463 Published 2023-11-18 No fix listed CWE-79

TI-2023-21560 CVE-2023-40814 · GHSA-chj5-8wxj-rxg8

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.

MEDIUM 60

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00463 Published 2023-11-18 No fix listed CWE-79

TI-2023-21559 CVE-2023-40813 · GHSA-5phw-6g3r-55xx

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.

MEDIUM 60

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00463 Published 2023-11-18 No fix listed CWE-79

TI-2023-21558 CVE-2023-40812 · GHSA-3g79-j8hq-r4xv

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.

MEDIUM 60

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00463 Published 2023-11-18 No fix listed CWE-79

TI-2023-21557 CVE-2023-40810 · GHSA-gx82-jm5q-gfw2

OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.

MEDIUM 60

OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00463 Published 2023-11-18 No fix listed CWE-79

TI-2023-21556 CVE-2023-40809 · GHSA-mfp5-vh58-3j3r

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.

MEDIUM 60

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00463 Published 2023-11-18 No fix listed CWE-94

TI-2023-25042 CVE-2023-46502 · GHSA-q74f-rf27-8hxc

An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute…

MEDIUM 51

An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00956 Published 2023-10-30 Fixed in 5.3.0 CWE-918

TI-2022-18982 CVE-2022-40084 · GHSA-j5v3-363p-g843

OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the…

MEDIUM 63

OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or I…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00783 Published 2022-10-20 Fixed in 5.2.2 CWE-203

TI-2021-07965 CVE-2021-25959 · GHSA-rwh9-8xx8-4wfm

OpenCRX - Reflected Cross-Site Scripting in Password Reset Functionality

LOW 29

In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00865 Published 2021-09-29 Fixed in 5.2.0 CWE-79

TI-2020-05963 CVE-2020-7378 · GHSA-94cq-h6f7-9rvw

CRIXP OpenCRX Unverified Password Change

MEDIUM 44

CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02617 Published 2020-11-24 No fix listed CWE-620