Vulnerabilities

TI-2019-13481 CVE-2019-18642 · GHSA-8r69-p3hj-6c77

Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user…

MEDIUM 45

Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile update feature.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01701 Published 2021-01-07 No fix listed

TI-2019-13482 CVE-2019-18643 · GHSA-8hmh-2f4f-8hr6

MEDIUM 49

Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04275 Published 2021-01-07 No fix listed CWE-434

TI-2019-13480 CVE-2019-18641 · GHSA-jm4r-px6v-v7q6

MEDIUM 48

Rock RMS before 1.8.6 mishandles vCard access control within the People/GetVCard/REST controller.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03431 Published 2020-03-20 No fix listed