Filtered by vendor Fogproject
Subscribe
Total
5 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-46236 | 1 Fogproject | 1 Fogproject | 2023-11-08 | N/A | 7.5 HIGH |
| FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch. | |||||
| CVE-2023-46237 | 1 Fogproject | 1 Fogproject | 2023-11-08 | N/A | 5.3 MEDIUM |
| FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue. | |||||
| CVE-2023-46235 | 1 Fogproject | 1 Fogproject | 2023-11-08 | N/A | 6.1 MEDIUM |
| FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the logs, they would be parsed as HTML and displayed accordingly. Version 1.5.10.15 contains a patch. As a workaround, view logs from an external text editor rather than the dashboard. | |||||
| CVE-2021-32243 | 1 Fogproject | 1 Fogproject | 2021-06-23 | 6.5 MEDIUM | 8.8 HIGH |
| FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated). | |||||
| CVE-2014-3111 | 1 Fogproject | 1 Fog | 2018-10-09 | 3.5 LOW | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Printer Model field to the Printer Management page, (2) Image Name field to the Image Management page, (3) Storage Group Name field to the Storage Management page, (4) Username field to the User Cleanup FOG Configuration page, or (5) Directory Path field to the Directory Cleaner FOG Configuration page. | |||||