Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
43 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
IKUS Rdiffweb version 2.10.5 and below have an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users data and, in some cases, perform privileged actions. This issue may enable cross-tenant access. Fixed in version 2.10.6.
Recommended action: Upgrade to 2.10.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4.
Recommended action: Upgrade to 2.8.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0.
Recommended action: Upgrade to 2.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In rdiffweb prior to 2.5.5, lack of sanitisation of characters in SSH key name could allow attacker to inject a hyperlink injection that could allow attacker to redirect victim to malicious websites.
Recommended action: Upgrade to 2.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Recommended action: Upgrade to 2.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Recommended action: Upgrade to 2.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Recommended action: Upgrade to 2.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In rdiffweb prior to 2.5.5, the username field is not unique to users. This allows exploitation of primary key logic by creating the same name with different combinations & may allow unauthorized access.
Recommended action: Upgrade to 2.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
rdiffweb prior to 2.5.5 has no rate limit on the "resend email feature" while enable or disable 2FA from /prefs/mfa endpoint .
Recommended action: Upgrade to 2.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
rdiffweb prior to version 2.5.4 has an Open Redirect vulnerability.
Recommended action: Upgrade to 2.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
rdiffweb prior to version 2.5.4 is vulnerable to Cross-Site Request Forgery (CSRF).
Recommended action: Upgrade to 2.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unauthorized access to settings update, logs , history, delete etc in GitHub repository ikus060/rdiffweb prior to 2.5.2.
Recommended action: Upgrade to 2.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
Recommended action: Upgrade to 2.5.0a6 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.
Recommended action: Upgrade to 2.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.
Recommended action: Upgrade to 2.5.0a7 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0.
Recommended action: Upgrade to 2.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
Recommended action: Upgrade to 2.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
Recommended action: Upgrade to 2.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ikus060/rdiffweb prior to 2.5.0a5 did not enforce origin validation in web traffic. Users are advised to upgrade to version 2.5.0a5.
Recommended action: Upgrade to 2.5.0a5 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A lack of user input validation leads to an open redirect vulnerability in rdiffweb prior to 2.5.0a4.
Recommended action: Upgrade to 2.5.0a4 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
rdiffweb prior to 2.4.10 is vulnerable to Path Traversal. Version 2.4.10 contains a patch.
Recommended action: Upgrade to 2.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
rdiffweb prior to 2.5.0a4 allows users to set their new password to be the same as the old password during a password reset. Version 2.5.0a4 enforces a password policy in which a new password cannot be the same as the old one.
Recommended action: Upgrade to 2.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
rdiffweb prior to 2.5.0a4 does not have a rate limit to prevent attackers attempting brute force attacks to guess passwords. Version 2.5.0a4 limits the number of incorrect password attempts.
Recommended action: Upgrade to 2.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
rdiffweb prior to 2.5.0a3 is vulnerable to Allocation of Resources Without Limits or Throttling. A lack of limit in the length of the Token name parameter can result in denial of service or memory corruption. Version 2.5.0a3 fixes this issue.
Recommended action: Upgrade to 2.5.0a3 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ikus060/rdiffweb prior to 2.4.9 allows a user to set there password to all spaces. While rdiffweb has a password policy requiring passwords to be between 8 and 128 characters, it does not validate the password entropy, allowing users to bypass password complexity requirements with weak passwords. This issue has been fixed in version 2.4.9. No workarounds are known to exist.
Recommended action: Upgrade to 2.4.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.