Vulnerabilities

TI-2021-09527 CVE-2021-28373 · GHSA-vv4w-hr59-hmw6

The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an…

LOW 35

The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the OTP code without a valid password.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00934 Published 2021-03-13 No fix listed CWE-863

TI-2020-15794 CVE-2020-25787 · GHSA-8966-pp95-9j6j

MEDIUM 60

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.18417 Published 2020-09-19 No fix listed CWE-20

TI-2020-15795 CVE-2020-25788 · GHSA-c9pq-99jp-354g

LOW 38

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01193 Published 2020-09-19 No fix listed CWE-829

TI-2020-15796 CVE-2020-25789 · GHSA-63f3-68q8-wr22

LOW 29

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00883 Published 2020-09-19 No fix listed CWE-79

TI-2017-12438 CVE-2017-16896 · GHSA-rrxw-67v8-59jr

MEDIUM 45

A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the login parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01478 Published 2017-11-20 No fix listed CWE-89

TI-2017-14381 CVE-2017-1000035 · GHSA-9gc3-6fq8-9hxj

LOW 29

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00888 Published 2017-07-13 No fix listed CWE-79