Vulnerabilities

TI-2007-04461 CVE-2007-4609 · GHSA-jwp9-qgrq-hqpw

eyeOS uses predictable checksum values in the checknum parameter for access control…

LOW 31

eyeOS uses predictable checksum values in the checknum parameter for access control, which allows remote attackers to register many accounts via doCreateUser actions, add many eyeBoard messages via addMsg actions, and ca…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.01382 Published 2007-08-31 No fix listed CWE-264

TI-2006-04887 CVE-2006-5071 · GHSA-h936-4hq7-5fvh

Multiple cross-site scripting (XSS) vulnerabilities in eyeOS before 0.9.1 allow remote…

LOW 23

Multiple cross-site scripting (XSS) vulnerabilities in eyeOS before 0.9.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) eyeNav and (2) system/baixar.php.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01299 Published 2006-09-28 No fix listed

TI-2006-00615 CVE-2006-0636 · GHSA-7xx2-j9qr-rjp6

desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the _SESSION variable…

LOW 37

desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the _SESSION variable before calling the session_start function, which allows remote attackers to execute arbitrary PHP code and possibly conduct other at…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01849 Published 2006-02-10 No fix listed

TI-2005-03237 CVE-2005-3414 · GHSA-cfm7-3295-jjpq

eyeOS 0.8.4 stores usrinfo.xml under the web document root with insufficient access…

LOW 36

eyeOS 0.8.4 stores usrinfo.xml under the web document root with insufficient access control, which allows remote attackers to obtain user credentials.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01705 Published 2005-11-01 No fix listed

TI-2005-03236 CVE-2005-3413 · GHSA-qwfr-mvx9-hhjf

Cross-site scripting (XSS) vulnerability in desktop.php in eyeOS 0.8.4 allows remote…