Filippo

7 exploits Active since Dec 2022
CVE-2022-23475 WRITEUP HIGH WRITEUP
daloradius < 1.3 - Cross-Site Request Forgery and Cross-Site Scripting in mng-del.php
daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting (XSS) and cross site request forgery (CSRF) vulnerability which leads to account takeover in the mng-del.php file because of an unescaped variable reflected in the DOM on line 116. This issue has been addressed in commit `ec3b4a419e`. Users are advised to manually apply the commit in order to mitigate this issue. Users may also mitigate this issue with in two parts 1) The CSRF vulnerability can be mitigated by making the daloRadius session cookie to samesite=Lax or by the implimentation of a CSRF token in all forms. 2) The XSS vulnerability may be mitigated by escaping it or by introducing a Content-Security policy.
CVSS 8.8
CVE-2022-4366 WRITEUP HIGH WRITEUP
GitHub lirantal/daloradius <master - Info Disclosure
Missing Authorization in GitHub repository lirantal/daloradius prior to master branch.
CVSS 7.5
CVE-2022-4630 WRITEUP MEDIUM WRITEUP
GitHub lirantal/daloradius <master - Info Disclosure
Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master.
CVSS 5.3
CVE-2023-0046 WRITEUP HIGH WRITEUP
GitHub lirantal/daloradius <master - Info Disclosure
Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch.
CVSS 7.2
CVE-2023-0048 WRITEUP HIGH WRITEUP
GitHub lirantal/daloradius <master - Code Injection
Code Injection in GitHub repository lirantal/daloradius prior to master-branch.
CVSS 8.8
CVE-2023-0337 WRITEUP MEDIUM WRITEUP
daloradius < 2023-01-18 - Reflected Cross-Site Scripting
Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.
CVSS 6.1
CVE-2023-0338 WRITEUP MEDIUM WRITEUP
daloradius < 2023-01-18 - Reflected Cross-Site Scripting
Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.
CVSS 6.1