Searchblox
Products
1- 17 CVEs
Recent CVEs
17| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-11586 | Cri | 0.68 | 9.8 | 0.15 | Jun 5, 2018 | XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. | ||
| CVE-2015-7919 | Cri | 0.67 | 10.0 | 0.22 | Dec 21, 2015 | SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application crash), via unspecified vectors. | ||
| CVE-2018-11538 | Hig | 0.61 | 8.8 | 0.13 | Jun 1, 2018 | servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass. | ||
| CVE-2015-0970 | Hig | 0.57 | 8.8 | 0.01 | Apr 18, 2015 | Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users. | ||
| CVE-2020-35580 | 0.07 | — | 0.14 | May 20, 2021 | A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the… | |||
| CVE-2013-3597 | 0.04 | — | 0.08 | Aug 28, 2013 | servlet/CollectionListServlet in SearchBlox before 7.5 build 1 allows remote attackers to read usernames and passwords via a getList action. | |||
| CVE-2020-10131 | 0.01 | — | 0.01 | Sep 6, 2023 | SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter. | |||
| CVE-2015-0969 | 0.01 | — | 0.14 | Apr 18, 2015 | SearchBlox before 8.2 allows remote attackers to obtain sensitive information via a pretty=true action to the _cluster/health URI. | |||
| CVE-2020-10132 | 0.00 | — | 0.01 | Sep 6, 2023 | SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration. | |||
| CVE-2020-10130 | 0.00 | — | 0.01 | Sep 6, 2023 | SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system. | |||
| CVE-2020-10129 | 0.00 | — | 0.01 | Sep 6, 2023 | SearchBlox before Version 9.2.1 is vulnerable to Privileged Escalation-Lower user is able to access Admin functionality. | |||
| CVE-2020-10128 | 0.00 | — | 0.00 | Sep 5, 2023 | SearchBlox product with version before 9.2.1 is vulnerable to stored cross-site scripting at multiple user input parameters. In SearchBlox products multiple parameters are not sanitized/validate properly which allows an attacker to inject malicious JavaScript. | |||
| CVE-2015-3422 | 0.00 | — | 0.02 | Jun 18, 2015 | Cross-site scripting (XSS) vulnerability in SearchBlox before 8.2.1 allows remote attackers to inject arbitrary web script or HTML via the menu2 parameter to admin/main.jsp. | |||
| CVE-2015-0968 | 0.00 | — | 0.03 | Apr 18, 2015 | Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 8.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension and the image/jpeg content type, a different vulnerability than CVE-2013-3590. | |||
| CVE-2015-0967 | 0.00 | — | 0.01 | Apr 18, 2015 | Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp. | |||
| CVE-2013-3598 | 0.00 | — | 0.02 | Aug 28, 2013 | Directory traversal vulnerability in servlet/CreateTemplateServlet in SearchBlox before 7.5 build 1 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the name parameter. | |||
| CVE-2013-3590 | 0.00 | — | 0.03 | Aug 28, 2013 | Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 7.5 build 1 allows remote attackers to execute arbitrary code by uploading an executable file with the image/jpeg content type, and then accessing this file via unspecified vectors, as… |
- risk 0.68cvss 9.8epss 0.15
XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
- risk 0.67cvss 10.0epss 0.22
SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application crash), via unspecified vectors.
- risk 0.61cvss 8.8epss 0.13
servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass.
- risk 0.57cvss 8.8epss 0.01
Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users.
- CVE-2020-35580May 20, 2021risk 0.07cvss —epss 0.14
A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the…
- CVE-2013-3597Aug 28, 2013risk 0.04cvss —epss 0.08
servlet/CollectionListServlet in SearchBlox before 7.5 build 1 allows remote attackers to read usernames and passwords via a getList action.
- CVE-2020-10131Sep 6, 2023risk 0.01cvss —epss 0.01
SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter.
- CVE-2015-0969Apr 18, 2015risk 0.01cvss —epss 0.14
SearchBlox before 8.2 allows remote attackers to obtain sensitive information via a pretty=true action to the _cluster/health URI.
- CVE-2020-10132Sep 6, 2023risk 0.00cvss —epss 0.01
SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration.
- CVE-2020-10130Sep 6, 2023risk 0.00cvss —epss 0.01
SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system.
- CVE-2020-10129Sep 6, 2023risk 0.00cvss —epss 0.01
SearchBlox before Version 9.2.1 is vulnerable to Privileged Escalation-Lower user is able to access Admin functionality.
- CVE-2020-10128Sep 5, 2023risk 0.00cvss —epss 0.00
SearchBlox product with version before 9.2.1 is vulnerable to stored cross-site scripting at multiple user input parameters. In SearchBlox products multiple parameters are not sanitized/validate properly which allows an attacker to inject malicious JavaScript.
- CVE-2015-3422Jun 18, 2015risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in SearchBlox before 8.2.1 allows remote attackers to inject arbitrary web script or HTML via the menu2 parameter to admin/main.jsp.
- CVE-2015-0968Apr 18, 2015risk 0.00cvss —epss 0.03
Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 8.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension and the image/jpeg content type, a different vulnerability than CVE-2013-3590.
- CVE-2015-0967Apr 18, 2015risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp.
- CVE-2013-3598Aug 28, 2013risk 0.00cvss —epss 0.02
Directory traversal vulnerability in servlet/CreateTemplateServlet in SearchBlox before 7.5 build 1 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the name parameter.
- CVE-2013-3590Aug 28, 2013risk 0.00cvss —epss 0.03
Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 7.5 build 1 allows remote attackers to execute arbitrary code by uploading an executable file with the image/jpeg content type, and then accessing this file via unspecified vectors, as…