Priority LOW 32
Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements.
CVSS 3.1HIGH 7.3· Adjacent network · Low privileges · No interaction · EPSS 0.00338 · Published 2023-11-02 · No fix listed CWE-89
Priority LOW 21
Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00577 · Published 2023-11-02 · No fix listed CWE-400
Priority LOW 25
Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00405 · Published 2023-11-02 · No fix listed CWE-79
Priority LOW 25
Documents operations could be manipulated to contain invalid data types, possibly script code.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00405 · Published 2023-11-02 · No fix listed CWE-79
Priority LOW 27
Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00378 · Published 2023-11-02 · No fix listed CWE-79
Priority LOW 25
Users were able to set an arbitrary "product name" for OX Guard.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00405 · Published 2023-11-02 · No fix listed CWE-79
Priority LOW 33
RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00198 · Published 2023-11-02 · No fix listed CWE-287
Priority LOW 38
Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00415 · Published 2023-11-02 · No fix listed CWE-89
Priority LOW 38
Requests to cache an image could be abused to include SQL queries that would be executed unchecked.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00415 · Published 2023-11-02 · No fix listed CWE-89
Priority LOW 38
Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00415 · Published 2023-11-02 · No fix listed CWE-89
THREATIST.IORead the docs