Vulnerabilities

TI-2023-04290 CVE-2023-4654 · GHSA-9q2q-rv8x-x676

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2

MEDIUM 50

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00339 Published 2023-08-31 Fixed in 2.16.1 CWE-614

TI-2023-04291 CVE-2023-4655 · GHSA-5x3r-fvpc-645c

MEDIUM 60

Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00467 Published 2023-08-31 Fixed in 2.16.1 CWE-79

TI-2023-04285 CVE-2023-4649 · GHSA-v6v4-5w5j-fcq8

MEDIUM 58

Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00438 Published 2023-08-31 Fixed in 2.16.1 CWE-384

TI-2023-04287 CVE-2023-4651 · GHSA-wrv9-8qw6-67rv

MEDIUM 58

Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00415 Published 2023-08-31 Fixed in 2.16.1 CWE-918