Pydio Cells
16 CVEs affecting Pydio Cells. Latest disclosed: 2023-06-08. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32749 | High | 8.8 | 2023-06-08 | Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such… |
CVE-2019-12901 | High | 8.8 | 2019-06-20 | Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an… |
CVE-2020-12851 | High | 8.1 | 2020-06-04 | Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells folders (repositories) by uploading a… |
CVE-2020-12847 | High | 7.2 | 2020-06-04 | Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator role. This console pr… |
CVE-2020-12850 | High | 7.0 | 2020-06-11 | The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF (such as version 2.0… |
CVE-2020-12852 | Medium | 6.8 | 2020-06-04 | The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update… |
CVE-2023-32750 | Medium | 6.5 | 2023-06-08 | Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "rem… |
CVE-2021-41324 | Medium | 6.5 | 2021-09-30 | Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files (or Cells files b… |
CVE-2021-41325 | Medium | 6.5 | 2021-09-30 | Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, su… |
CVE-2021-41323 | Medium | 6.5 | 2021-09-30 | Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells files belonging to any… |
CVE-2019-12902 | Medium | 6.5 | 2019-06-20 | Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore… |
CVE-2020-12853 | Medium | 6.1 | 2020-06-04 | Pydio Cells 2.0.4 allows XSS. A malicious user can either upload or create a new file that contains potentially malicious HTML and JavaScript code to personal… |
CVE-2023-32751 | Medium | 5.4 | 2023-06-08 | Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaSc… |
CVE-2020-12849 | Medium | 5.4 | 2020-06-05 | Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later… |
CVE-2020-12848 | Medium | 5.4 | 2020-06-05 | In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backen… |
CVE-2019-12903 | Medium | 4.3 | 2019-06-20 | Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as… |