PyPI package
koji
pkg:pypi/koji
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-9427 | Med | 5.4 | >= 1.35.0, < 1.35.1 | 1.35.1 | Dec 24, 2024 | A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web page. It is not expected to be able to submit an action or make a change in Koji due to existing XSS protections in the | |
| CVE-2019-17109 | — | >= 1.14.0, < 1.14.3 | 1.14.3 | Oct 9, 2019 | Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation. | ||
| CVE-2018-1002150 | Cri | 9.1 | >= 1.15, < 1.15.1 | 1.15.1 | Apr 4, 2018 | Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access. This vulnerability has been fixed in versions 1.12.1, 1.13.1, 1.14.1 and 1.15.1. | |
| CVE-2017-1002153 | Hig | 7.5 | < 1.15.0 | 1.15.0 | Oct 6, 2017 | Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission. |
- affected >= 1.35.0, < 1.35.1fixed 1.35.1
A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web page. It is not expected to be able to submit an action or make a change in Koji due to existing XSS protections in the
- CVE-2019-17109Oct 9, 2019affected >= 1.14.0, < 1.14.3fixed 1.14.3
Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.
- affected >= 1.15, < 1.15.1fixed 1.15.1
Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access. This vulnerability has been fixed in versions 1.12.1, 1.13.1, 1.14.1 and 1.15.1.
- affected < 1.15.0fixed 1.15.0
Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.