PyPI package
radicale
pkg:pypi/radicale
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2017-8342 | Hig | 8.1 | < 1.1.2 | 1.1.2 | Apr 30, 2017 | Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method. | |
| CVE-2016-1505 | Cri | 10.0 | < 1.1 | 1.1 | Feb 3, 2016 | The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore. | |
| CVE-2015-8748 | Med | 5.3 | < 1.1 | 1.1 | Feb 3, 2016 | Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*". | |
| CVE-2015-8747 | Cri | 10.0 | < 1.1 | 1.1 | Feb 3, 2016 | The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name. |
- affected < 1.1.2fixed 1.1.2
Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.
- affected < 1.1fixed 1.1
The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.
- affected < 1.1fixed 1.1
Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*".
- affected < 1.1fixed 1.1
The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.