Vulnerabilities

TI-2023-23796 CVE-2023-44272 · GHSA-j24p-mq7x-2jwp

Cross-site scripting in Citadel

LOW 25

A cross-site scripting vulnerability exists in Citadel versions prior to 994.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00534 Published 2023-10-04 Fixed in 994 CWE-79

TI-2021-15654 CVE-2021-37845 · GHSA-hh3j-j42w-mrpm

An issue was discovered in Citadel through webcit-932.

LOW 19

An issue was discovered in Citadel through webcit-932.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00665 Published 2023-05-29 No fix listed

TI-2020-17741 CVE-2020-29547 · GHSA-xhj4-5383-37r2

An issue was discovered in Citadel through webcit-926.

LOW 28

An issue was discovered in Citadel through webcit-926.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00753 Published 2023-05-29 No fix listed CWE-77

TI-2020-16824 CVE-2020-27739 · GHSA-f928-h33x-jm46

A Weak Session Management vulnerability in Citadel WebCit through 926 allows…

MEDIUM 46

A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01836 Published 2020-10-28 No fix listed CWE-613

TI-2020-16827 CVE-2020-27742 · GHSA-p628-386j-64h8

An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows…

LOW 31

An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else's emails via the msg_confirm_move template.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0115 Published 2020-10-28 No fix listed CWE-639

TI-2020-16826 CVE-2020-27741 · GHSA-xw7p-c2fg-6hg3

Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow…

LOW 29

Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01082 Published 2020-10-28 No fix listed CWE-79

TI-2020-16825 CVE-2020-27740 · GHSA-8mh6-v49g-9mfp

Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid…

LOW 27

Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01292 Published 2020-10-28 No fix listed

TI-2011-01535 CVE-2011-1756 · GHSA-6px8-r2g4-9v5v

modules/xmpp/serv_xmpp.c in Citadel 7.86 and earlier does not properly detect recursion…

LOW 28

modules/xmpp/serv_xmpp.c in Citadel 7.86 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML d…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0266 Published 2011-06-21 No fix listed CWE-399

TI-2009-00344 CVE-2009-0364 · GHSA-rffq-q3v2-pw4q

Format string vulnerability in the mini_calendar component in Citadel.org WebCit 7.22…

LOW 38

Format string vulnerability in the mini_calendar component in Citadel.org WebCit 7.22, and other versions before 7.39, allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02594 Published 2009-03-24 No fix listed CWE-134

TI-2008-00369 CVE-2008-0394 · GHSA-2jx4-7qpj-c9gc

Buffer overflow in Citadel SMTP server 7.10 and earlier allows remote attackers to…

MEDIUM 47

Buffer overflow in Citadel SMTP server 7.10 and earlier allows remote attackers to execute arbitrary code via a long RCPT TO command, which is not properly handled by the makeuserkey function.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.11948 Published 2008-01-23 No fix listed CWE-119

TI-2007-03706 CVE-2007-3822 · GHSA-f76m-wr28-86f7

Multiple cross-site scripting (XSS) vulnerabilities in Webcit before 7.11 allow remote…

LOW 18

Multiple cross-site scripting (XSS) vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via (1) the who parameter to showuser; and other vectors involving (2) calendar mode…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.02478 Published 2007-07-17 No fix listed

TI-2007-03705 CVE-2007-3821 · GHSA-9rjr-pq6m-pxx6

Cross-site request forgery (CSRF) vulnerability in Webcit before 7.11 allows remote…

LOW 38

Cross-site request forgery (CSRF) vulnerability in Webcit before 7.11 allows remote attackers to modify configurations and perform other actions as arbitrary users via unspecified vectors.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02744 Published 2007-07-17 No fix listed

TI-2004-01581 CVE-2004-1705 · GHSA-2vjq-g46g-w383

Buffer overflow in Citadel/UX 6.23 and earlier allows remote attackers to cause a denial of service via a long username.

LOW 31

Buffer overflow in Citadel/UX 6.23 and earlier allows remote attackers to cause a denial of service via a long username.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04918 Published 2005-02-26 No fix listed

TI-2004-01085 CVE-2004-1192 · GHSA-cv96-99r4-547h

Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows…

MEDIUM 56

Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows remote attackers to execute arbitrary code via format string specifiers sent to the server.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.11746 Published 2004-12-15 No fix listed

TI-2002-00417 CVE-2002-0432 · GHSA-5jgh-8rfm-7jj2

Buffer overflow in (1) lprintf and (2) cprintf in sysdep.c of Citadel/UX 5.90 and earlier…

MEDIUM 51

Buffer overflow in (1) lprintf and (2) cprintf in sysdep.c of Citadel/UX 5.90 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attacks such as a long HELO c…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05604 Published 2002-06-11 No fix listed

Vulnerabilities

Filters