Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

CVE-2024-28232

Username Enumeration in CasaOS via bypass of CVE-2024-24766

Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Icewhale Icewhaletech
Products
Casaos-userservice Casaos-userservice
CVE-2023-37469

CasaOS Command Injection vulnerability

CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Icewhale Icewhaletech
Products
Casaos Casaos-userservice