repository icon
ikus060 / rdiffweb Project repository

A simplified backup management software for quick access to your archives through an efficient web interface.

Submit a report

FIRST INTERACTION

WITHIN8 DAYS

REVIEW

WITHIN9 DAYS

FIX

WITHIN32 DAYS

No rate limiting on creating access token
pullakarthiksrivastav
High
•CVE-2023-5289
No rate limit on send report functionality results in an email spam
nehalr777
Medium
•CVE-2023-4138
Bypass rate limiting at login form lead to perform brute-force attack
nhienit2010
informative
High
Application allows to add same SSH key among different users
nehalr777
High
•CVE-2022-4724
Username field are not unique to users allowing exploitation of primary key logi...
raiders0786
High
•CVE-2022-4722
Lack of Email verification on client-side leads to email change of any user by a...
raiders0786
informative
Medium
No rate limit on "resend email feature" while enable or disable 2FA from /prefs/...
nehalr777
Medium
•CVE-2022-4723
Improper Access Control Mechanism on Adding User Role leads to excessive permiss...
raiders0786
informative
Critical
Lack of sanitisation of characters in SSH key name could allow attacker to injec...
nehalr777
Medium
•CVE-2022-4721
Hyperlink injection through access token name
nehalr777
Medium
•CVE-2022-4720
No notification triggered on sensitive actions like adding SSH key
nehalr777
Medium
•CVE-2022-4719
Lack of CSRF Token in Logout
rezaduty
Medium
•CVE-2022-4646
Log Injection in User Root Directory
rezaduty
informative
Medium
Content Injection via Host Header injection(X-Forwarded-For)
rezaduty
informative
Medium
Host Header Injection via Host
rezaduty
informative
Medium
Open Redirect using Host header Injection
anishkashukla
Medium
•CVE-2022-4644
Unauthorized access to settings update, logs , history, delete etc of repositori...
neverjunior
Medium
•CVE-2022-4314
Unauthorized access to settings update, logs , history, delete etc of repositori...
neverjunior
duplicate
Medium
Origin validation Bypass
nithissh200
Low
•CVE-2022-3457
Using application logic to create an email spam attack
nehalr777
Medium
•CVE-2022-3456
2 FA bypass
nehalr777
High
Path Traversal (CWE-22) leak sensitive data
sk4rl1ght
High
•CVE-2022-3389
Weak password policy : Old password can be set as new password
nehalr777
Low
•CVE-2022-3376
No limit in length of "Token name" parameter results in DOS attack /memory corru...
nehalr777
High
•CVE-2022-3371
No limit in length of "Fullname" parameter results in DOS attack /memory corrupt...
nehalr777
Medium
•CVE-2022-3364
Attacker is able to bypass 2FA verification during 2FA disable due to applicatio...
nehalr777
Medium
•CVE-2022-4018
No notification triggered on sensitive actions like 2FA enable/disable
nehalr777
Low
•CVE-2022-3363
Session does not expire on password reset
nehalr777
Medium
•CVE-2022-3362
No rate limit on email triggering during "resend email" action results in email...
nehalr777
Medium
•CVE-2022-3439
Hyperlink injection leads to redirect victim to malicious website
nehalr777
Medium
•CVE-2022-3438
CSRF on logout
nehalr777
informative
Medium
Bypassing application logic to set a blank password
nehalr777
Medium
•CVE-2022-3326
No password confirmation on sensitive action like email change
nehalr777
Medium
•CVE-2022-3327
No login CSRF protection
nehalr777
self closed
No Limit in "title" length while adding SSH key , results in memory consumption/...
nehalr777
Medium
•CVE-2022-3298
No Limit in length of root directory name , results in memory consumption/DOS at...
nehalr777
Medium
•CVE-2022-3295
No Limit in length of username , results in memory consumption/DOS attack
nehalr777
Medium
•CVE-2022-3290
Improper Cache control allows attacker to view sensitive data
nehalr777
Medium
•CVE-2022-3292
Cross Site Request forgery to add SSH key
nehalr777
self closed
No rate limit on old password parameter allows attacker to bruteforce the existi...
nehalr777
Low
•CVE-2022-3273
No limit in email length may result in a possible DOS attack
nehalr777
Medium
•CVE-2022-3272
Virual defacement allows attacker to display any message of his choice
nehalr777
Medium
•CVE-2022-3301
CSRF to change the email id
irfansayyed-github
High
•CVE-2022-3274
Secure token is missed when ivalid URL is entered
irfansayyed-github
Medium
•CVE-2022-3250
The server supports X-Fowarded header
irfansayyed-github
spam
The settings of repositories is vulnerable to CSRF
irfansayyed-github
Medium
•CVE-2022-3267
broken authentication - logout management in ikus060 / rdiffweb
fpdh0104
self closed
Cookie is persisting in the browser which leads to Session Fixation
ciph0x01
Medium
•CVE-2022-3269
CSRF leads to disabling notifications in users profile
ciph0x01
Medium
•CVE-2022-3233
Cross Site Request Forgery in Admin area leads to deletion of repositories and u...
ciph0x01
Medium
•CVE-2022-3232
CSRF resulting in Account Takeover
mdakh404
High
Cross Site Request Forgery in profile's "SSH Keys" leads to unauthorized access...
ciph0x01
High
•CVE-2022-3221
Bypass IP detection to brute-force password in ikus060/rdiffweb
meme-dm
High
"password" detected here, review this potentially hard-coded credential.
gellanyhassan0
not applicable
Cross-Site Request Forgery (CSRF) (add admin,del users ..etc)
ph33rr
not applicable
Unrestricted access to Odoo DB manager in rdiffweb.org
anhdq201
informative
High
Password can be set extremely weak
uonghoangminhchau
High
•CVE-2022-3179
Error page is default and leak error information
uonghoangminhchau
Medium
•CVE-2022-3175
Session_id without Secure attribute
uonghoangminhchau
High
•CVE-2022-3174
Password returned in later response
juylang
not applicable
UI REDRESSING
tharunavula
Critical
•CVE-2022-3167
Open Redirect
nhiephon
Medium
Open Redirect
asura-n
Low
•$1
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$25
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$25
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$25
Cross-Site Request Forgery (CSRF)
am0o0
High
•$25
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$25