CPE Details
ProjectSend R1605
r1605
2023-02-08
13h22 +00:00
13h22 +00:00
2023-03-03
15h21 +00:00
15h21 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
CPE Name: cpe:2.3:a:projectsend:projectsend:r1605:*:*:*:*:*:*:*
Informations
Vendor
projectsendProduct
projectsendVersion
r1605Related CVE
| CVE ID | Published | Description | Score | Severity |
|---|---|---|---|---|
| ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. | 9.8 |
Critical |
||
| A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file includes/functions.php of the component Password Reset Token Handler. The manipulation leads to insufficiently random values. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version r1720 is able to address this issue. The name of the patch is aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17. It is recommended to upgrade the affected component. | 6.3 |
Medium |
||
| A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component. | 6.9 |
Medium |
||
| Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606. | 4.8 |
Medium |
