Vulnerabilities

TI-2024-05025 CVE-2024-5409

Cross-site Scripting vulnerability in RhinOS from SaltOS

LOW 31

RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0028 Published 2024-05-27 No fix listed CWE-79

TI-2024-05024 CVE-2024-5408

LOW 31

Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00334 Published 2024-05-27 No fix listed CWE-79

TI-2024-05023 CVE-2024-5407

MEDIUM 50

A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00604 Published 2024-05-27 No fix listed CWE-94

TI-2018-13278 CVE-2018-18762 · GHSA-qwxx-r7ph-8m3q

LOW 38

SaltOS 3.1 r8126 contains a database download vulnerability.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.06189 Published 2019-03-17 No fix listed CWE-200

TI-2018-13279 CVE-2018-18763 · GHSA-jxf2-84cf-jfqp

MEDIUM 48

SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03213 Published 2018-11-16 No fix listed CWE-89

TI-2018-13277 CVE-2018-18761 · GHSA-xwm8-c743-c377

MEDIUM 59

SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.16456 Published 2018-11-16 No fix listed CWE-89

TI-2018-13276 CVE-2018-18760 · GHSA-7v25-cx6v-gf9w

LOW 34

RhinOS 3.0 build 1190 allows CSRF.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.02627 Published 2018-11-16 No fix listed CWE-352