PartKeepr
by PartKeepr
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-22701 | Med | 0.42 | 6.5 | 0.01 | Jan 10, 2022 | PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated user to read local files. | ||
| CVE-2021-39390 | Med | 0.35 | 5.4 | 0.01 | May 3, 2022 | Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter. | ||
| CVE-2022-30899 | Med | 0.31 | 4.8 | 0.00 | Jun 8, 2022 | A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories. | ||
| CVE-2022-22702 | Med | 0.28 | 4.3 | 0.01 | Jan 10, 2022 | PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to local ports, allowing an authenticated user to carry out SSRF attacks and port enumeration. |
- risk 0.42cvss 6.5epss 0.01
PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated user to read local files.
- risk 0.35cvss 5.4epss 0.01
Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter.
- risk 0.31cvss 4.8epss 0.00
A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories.
- risk 0.28cvss 4.3epss 0.01
PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to local ports, allowing an authenticated user to carry out SSRF attacks and port enumeration.