Open Audit
by Open Audit
Source repositories
CVEs (7)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-11942 | Cri | 0.64 | 9.8 | 0.01 | Apr 29, 2020 | An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections. | ||
| CVE-2020-11943 | Hig | 0.59 | 8.8 | 0.24 | Apr 29, 2020 | An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload. | ||
| CVE-2020-11941 | Hig | 0.58 | 8.8 | 0.05 | Apr 27, 2020 | An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery. | ||
| CVE-2019-16293 | Hig | 0.50 | 8.8 | 0.02 | Sep 13, 2019 | The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field. | ||
| CVE-2018-11124 | Med | 0.38 | 5.4 | 0.02 | Jul 6, 2018 | Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute. | ||
| CVE-2018-8978 | Med | 0.35 | 5.4 | 0.01 | Mar 25, 2018 | Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI. | ||
| CVE-2020-12078 | Hig | 0.01 | 8.8 | 0.10 | Apr 28, 2020 | An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip… |
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections.
- risk 0.59cvss 8.8epss 0.24
An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload.
- risk 0.58cvss 8.8epss 0.05
An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery.
- risk 0.50cvss 8.8epss 0.02
The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field.
- risk 0.38cvss 5.4epss 0.02
Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute.
- risk 0.35cvss 5.4epss 0.01
Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI.
- risk 0.01cvss 8.8epss 0.10
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip…