Serpico Project Serpico
7 CVEs affecting Serpico Project Serpico. Latest disclosed: 2020-05-07. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19854 | High | 8.8 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. It does not use CSRF Tokens to mitigate against CSRF; it uses the… |
CVE-2020-12687 | Medium | 6.5 | 2020-05-07 | An issue was discovered in Serpico before 1.3.3. The /admin/attacments_backup endpoint can be requested by non-admin authenticated users. This means that an at… |
CVE-2019-19857 | Medium | 6.5 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An admin can change their password without providing the current p… |
CVE-2019-19859 | Medium | 5.3 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The Add Collaborator allows unlimited data via the author paramete… |
CVE-2019-19858 | Medium | 4.8 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/add_user/UID allows stored XSS via the author parameter. |
CVE-2019-19856 | Medium | 4.8 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The User Type on the admin/list_user page allows stored XSS via th… |
CVE-2019-19855 | Medium | 4.8 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/list_user allows stored XSS via the auth_type parameter. |