Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
14 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information and affects all versions prior to the fix.
Recommended action: Upgrade to 0.6.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the createshelf method in shelf.py not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.
Recommended action: Upgrade to 0.6.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file editbooks.js. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the #btn-upload-cover change event.
Recommended action: Upgrade to 0.6.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.
Recommended action: Upgrade to 0.6.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.
Recommended action: Upgrade to 0.6.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Calibre-Web before 0.6.18 allows user table SQL Injection.
Recommended action: Upgrade to 0.6.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is due to an incomplete fix for CVE-2022-0339. The blacklist does not check for `0.0.0.0`, which would result in a payload of `0.0.0.0` resolving to `localhost`.
Recommended action: Upgrade to 0.6.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to `localhost`.
Recommended action: Upgrade to 0.6.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
calibreweb prior to version 0.6.16 contains a Server-Side Request Forgery (SSRF) vulnerability.
Recommended action: Upgrade to 0.6.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
calibreweb prior to version 0.6.16 contains an Incorrect Authorization vulnerability.
Recommended action: Upgrade to 0.6.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
calibreweb prior to version 0.6.16 contains a cross-site scripting vulnerability.
Recommended action: Upgrade to 0.6.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Recommended action: Upgrade to 0.6.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
Recommended action: Upgrade to 0.6.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
calibre-web is vulnerable to Business Logic Errors
Recommended action: Upgrade to 0.6.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.