Filtered by vendor Projectsend
Subscriptions
Filtered by product Projectsend
Subscriptions
Total
24 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-7659 | 1 Projectsend | 1 Projectsend | 2024-08-15 | 3.7 Low |
| A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file includes/functions.php of the component Password Reset Token Handler. The manipulation leads to insufficiently random values. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version r1720 is able to address this issue. The name of the patch is aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17. It is recommended to upgrade the affected component. | ||||
| CVE-2024-7658 | 1 Projectsend | 1 Projectsend | 2024-08-13 | 5.3 Medium |
| A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component. | ||||
| CVE-2014-9580 | 1 Projectsend | 1 Projectsend | 2024-08-06 | N/A |
| Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload. NOTE: this issue was originally incorrectly mapped to CVE-2014-1155; see CVE-2014-1155 for more information. | ||||
| CVE-2014-9567 | 1 Projectsend | 1 Projectsend | 2024-08-06 | N/A |
| Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory. | ||||
| CVE-2015-2564 | 1 Projectsend | 1 Projectsend | 2024-08-06 | N/A |
| SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php. | ||||
| CVE-2016-10732 | 1 Projectsend | 1 Projectsend | 2024-08-06 | N/A |
| ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php. | ||||
| CVE-2016-10731 | 1 Projectsend | 1 Projectsend | 2024-08-06 | N/A |
| ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the request parameter file, or home-log.php with the request parameter action. | ||||
| CVE-2016-10734 | 1 Projectsend | 1 Projectsend | 2024-08-06 | N/A |
| ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php. | ||||
| CVE-2016-10733 | 1 Projectsend | 1 Projectsend | 2024-08-06 | N/A |
| ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string. | ||||
| CVE-2017-20101 | 1 Projectsend | 1 Projectsend | 2024-08-05 | 3.5 Low |
| A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely. | ||||
| CVE-2017-9786 | 1 Projectsend | 1 Projectsend | 2024-08-05 | N/A |
| Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php. | ||||
| CVE-2017-9783 | 1 Projectsend | 1 Projectsend | 2024-08-05 | N/A |
| Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in a Site name updated. | ||||
| CVE-2017-9741 | 1 Projectsend | 1 Projectsend | 2024-08-05 | N/A |
| install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file. | ||||
| CVE-2018-7201 | 1 Projectsend | 1 Projectsend | 2024-08-05 | N/A |
| CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel. | ||||
| CVE-2018-7202 | 1 Projectsend | 1 Projectsend | 2024-08-05 | N/A |
| An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page. | ||||
| CVE-2019-11533 | 1 Projectsend | 1 Projectsend | 2024-08-04 | N/A |
| Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML. | ||||
| CVE-2019-11492 | 1 Projectsend | 1 Projectsend | 2024-08-04 | N/A |
| ProjectSend before r1070 writes user passwords to the server logs. | ||||
| CVE-2019-11378 | 1 Projectsend | 1 Projectsend | 2024-08-04 | N/A |
| An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code. | ||||
| CVE-2020-28874 | 1 Projectsend | 1 Projectsend | 2024-08-04 | 7.5 High |
| reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter). | ||||
| CVE-2021-40886 | 1 Projectsend | 1 Projectsend | 2024-08-04 | 6.5 Medium |
| Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization. | ||||