Vulnerabilities

After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosure

Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username

When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types.

GMOD Apollo does not have sufficient logical or access checks when updating a user's information.

GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests.

Cross-site scripting (XSS) vulnerability in GMOD GBrowse before 1.69 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.