TI-2022-09145 CVE-2022-25512 · GHSA-9988-f88m-mr42
FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.
Priority LOW 35
FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.
Vulnerabilities
6 records
TI-2022-09144 CVE-2022-25511 · GHSA-7cr9-rmqr-fpqp
An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI…
Priority LOW 30
An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system.
TI-2022-09143 CVE-2022-25510 · GHSA-f897-875p-23x7
FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to…
Priority MEDIUM 40
FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.
TI-2022-09142 CVE-2022-25508 · GHSA-hggv-mcp4-vxc5
An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8…
Priority LOW 35
An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsaf…
TI-2022-09141 CVE-2022-25507 · GHSA-gjh6-wvhq-h4qx
FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS)…
Priority LOW 25
FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.
TI-2022-09140 CVE-2022-25506 · GHSA-jr2m-29wj-w9qc
FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.
Priority LOW 30
FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.