Vulnerabilities

TI-2023-11999 CVE-2023-27246 · GHSA-2fwx-cj48-8qqf

An arbitrary file upload vulnerability in the Virtual Disk of MK-Auth 23.01K4.9 allows…

MEDIUM 41

An arbitrary file upload vulnerability in the Virtual Disk of MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted .htaccess file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.008 Published 2023-03-28 No fix listed CWE-434

TI-2021-04593 CVE-2021-21495 · GHSA-xgvj-75pc-8x47

MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the…

LOW 39

MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar_central.php?acao=altsenha_princ URI.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00535 Published 2021-01-04 No fix listed CWE-352

TI-2021-04592 CVE-2021-21494 · GHSA-w46m-mpvw-cv2h

MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter.

LOW 23

MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00518 Published 2021-01-04 No fix listed CWE-732

TI-2021-02148 CVE-2021-3005 · GHSA-4qc6-wq65-6w7q

MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g…

LOW 22

MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g., a CPF number) via a modified titulo (aka invoice number) value to the central/recibo.php URI.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00867 Published 2021-01-03 No fix listed

TI-2020-11024 CVE-2020-14072 · GHSA-8wrr-g5w6-457w