Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
pydio vulnerabilities and exploits
(subscribe to this query)
6.1
CVSSv3
CVE-2018-1999016
Pydio version 8.2.0 and previous versions contains a Cross Site Scripting (XSS) vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated ...
Pydio Pydio
4.9
CVSSv3
CVE-2018-1999017
Pydio version 8.2.0 and previous versions contains a Server-Side Request Forgery (SSRF) vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath($url) that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests th...
Pydio Pydio
6.6
CVSSv3
CVE-2018-1999018
Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow($nodeObject) that can result in An attacker gaining admin access and can then execute arbitrar...
Pydio Pydio
6.5
CVSSv3
CVE-2019-10045
The "action" get_sess_id in the web application of Pydio up to and including 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an malicious user to impersonate a user and perform ...
Pydio Pydio
5.4
CVSSv3
CVE-2019-10047
A stored XSS vulnerability exists in the web application of Pydio up to and including 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards ...
Pydio Pydio
7.2
CVSSv3
CVE-2019-10048
The ImageMagick plugin that is installed by default in Pydio up to and including 8.2.2 does not perform the appropriate validation and sanitization of user supplied input in the plugin's configuration options, allowing arbitrary shell commands to be entered that result in co...
Pydio Pydio
7.3
CVSSv3
CVE-2019-10049
It is possible for an attacker with regular user access to the web application of Pydio up to and including 8.2.2 to trick an administrator user into opening a link shared through the application, that in turn opens a shared file that contains JavaScript code (that is executed in...
Pydio Pydio
9.8
CVSSv3
CVE-2015-3431
Pydio (formerly AjaXplorer) prior to 6.0.7 allows remote malicious users to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."
Pydio Pydio
6.1
CVSSv3
CVE-2015-3432
Multiple cross-site scripting (XSS) vulnerabilities in Pydio (formerly AjaXplorer) prior to 6.0.7 allow remote malicious users to inject arbitrary web script or HTML via unspecified vectors, aka "Pydio XSS Vulnerabilities."
Pydio Pydio
9.8
CVSSv3
CVE-2013-4267
Ajaxeplorer prior to 5.0.1 allows remote malicious users to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS module (plugins/action.powerfs/class.PowerFSController.php), a (2) file name to the getTrustSizeOnFileSystem function ...
Pydio Pydio
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322
cross-site request forgery
unauthorized
CVE-2024-33925
reflected XSS
CVE-2023-51580
CVE-2023-51579
CVE-2015-2051
CVE-2023-51609
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
NEXT »