Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Petereport Project Component: Petereport Clear all filters
TI-2022-08933 CVE-2022-25220 · GHSA-xfg6-9h5g-pxpr

Cross-site scripting in PeTeReport

Priority LOW 23

PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code inside the markdown descriptions while creating a product, report or finding.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00557 Published 2022-03-03 No fix listed CWE-79
TI-2022-07226 CVE-2022-23052 · GHSA-mvf8-mv9q-4hv5

Cross-site request forgery in PeTeReport

Priority LOW 29

PeteReport Version 0.5 contains a Cross Site Request Forgery (CSRF) vulnerability allowing an attacker to trick users into deleting users, products, reports and findings on the application.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00445 Published 2022-03-03 No fix listed CWE-352
TI-2022-07225 CVE-2022-23051 · GHSA-9rwp-j6mp-jgwf

Cross-site scripting in PeTeReport

Priority LOW 25

PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the 'svg_file' parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00524 Published 2022-03-03 No fix listed CWE-79