Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: unclebob Clear all filters
TI-2024-26540 CVE-2024-39610 · GHSA-pg82-9w35-3w3r

Cross-site scripting in unclebob FitNesse

Priority LOW 28

Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2024-11-15 Fixed in 20241026 CWE-79
TI-2024-28466 CVE-2024-42499 · GHSA-q297-5ff8-hc92

Path traversal in unclebob FitNesse

Priority LOW 31

Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00667 Published 2024-11-15 Fixed in 20241026 CWE-22
TI-2024-18633 CVE-2024-28039 · GHSA-rcfj-pc73-hqv6

XML external entity injection in unclebob FitNesse

Priority LOW 35

Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain sensitive information, alter data, or cause a denial-of-servi…

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00726 Published 2024-03-18 No fix listed CWE-611
TI-2024-18707 CVE-2024-28128 · GHSA-mjq8-gg9x-87gr

Cross-site scripting in unclebob FitNesse

Priority LOW 28

Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product a…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0057 Published 2024-03-18 Fixed in 20220319 CWE-79
TI-2024-18704 CVE-2024-28125 · GHSA-x9r9-48rm-4xm6

OS command injection in unclebob FitNesse

Priority MEDIUM 51

FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00992 Published 2024-03-18 No fix listed CWE-78
TI-2024-15626 CVE-2024-23604 · GHSA-8xjc-25qh-f5x2

Cross-site scripting in unclebob FitNesse

Priority LOW 28

Cross-site scripting vulnerability exists in FitNesse all releases, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00574 Published 2024-03-18 No fix listed CWE-79