Vulnerabilities

TI-2019-08036 CVE-2019-10771 · GHSA-6rjc-4pwr-3vp7

Characters in the GET url path are not properly escaped and can be reflected in the server response.

LOW 28

Characters in the GET url path are not properly escaped and can be reflected in the server response.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00679 Published 2019-11-25 Fixed in 2.4.10 CWE-79

TI-2019-08032 CVE-2019-10767 · GHSA-cmch-296j-wfvw

LOW 37

An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin".

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02158 Published 2019-11-21 Fixed in 2.0.25 CWE-22

TI-2019-08030 CVE-2019-10765 · GHSA-54xj-q58h-9x57

MEDIUM 45

iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01714 Published 2019-11-20 Fixed in 3.6.12 CWE-22