Vulnerabilities

TI-2017-06745 CVE-2017-9307 · GHSA-fwcr-p45j-g3cw

SSRF vulnerability in remotedownload.php in Allen Disk 1.6 allows remote authenticated…

LOW 31

SSRF vulnerability in remotedownload.php in Allen Disk 1.6 allows remote authenticated users to conduct port scans and access intranet servers via a crafted file parameter.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00894 Published 2017-05-31 No fix listed CWE-918

TI-2017-06691 CVE-2017-9249 · GHSA-669w-jhfq-mj6p

Cross-site scripting (XSS) vulnerability in Allen Disk 1.6 allows remote authenticated…

LOW 26

Cross-site scripting (XSS) vulnerability in Allen Disk 1.6 allows remote authenticated users to inject arbitrary web script or HTML persistently by uploading a crafted HTML file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0068 Published 2017-05-28 No fix listed CWE-79

TI-2017-06546 CVE-2017-9091 · GHSA-44m6-j5rj-h6pv

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])…

LOW 35

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code']) == 1, which leads to CAPTCHA bypass by emptying $_POST['captcha'].

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01306 Published 2017-05-19 No fix listed CWE-20

TI-2017-06545 CVE-2017-9090 · GHSA-fhph-5g4h-87mq

reg.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])==1, which…

LOW 35

reg.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])==1, which makes it possible to bypass the CAPTCHA via an empty $_POST['captcha'].

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01306 Published 2017-05-19 No fix listed CWE-20

TI-2017-06356 CVE-2017-8848 · GHSA-f8qx-xf75-phhp

Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password.

LOW 29

Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00487 Published 2017-05-08 No fix listed CWE-352

TI-2017-06340 CVE-2017-8832 · GHSA-w86c-fh37-jvpq

Allen Disk 1.6 has XSS in the id parameter to downfile.php.

LOW 28

Allen Disk 1.6 has XSS in the id parameter to downfile.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00631 Published 2017-05-08 No fix listed CWE-79

Vulnerabilities

Filters

SSRF vulnerability in remotedownload.php in Allen Disk 1.6 allows remote authenticated…

Cross-site scripting (XSS) vulnerability in Allen Disk 1.6 allows remote authenticated…

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])…

reg.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])==1, which…

Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password.

Allen Disk 1.6 has XSS in the id parameter to downfile.php.