Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 47

Export CSV
CVE-2026-109118

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb

Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2026-109119

Missing Authorization in rdiffweb

Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2025-67796

Improper Authorization Allows Cross‑Tenant Data Access in IKUS Rdiffweb

IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users data and, in some cases, perform privileged actions. This issue may enable cross-tenant access. Fixed in version 2.10.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3251

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/minarca

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Minarca
CVE-2022-3250

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3233

Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb

Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3268

Weak Password Requirements in ikus060/minarca

Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Ikus-soft
Products
Minarca
CVE-2022-3267

Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb

Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3274

Cross-Site Request Forgery (CSRF) on user's settings in GitHub repository ikus060/rdiffweb prior to 2.4.6. in ikus060/rdiffweb

Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3269

Session Fixation in ikus060/rdiffweb

Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3295

Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3290

Improper Handling of Length Parameter Inconsistency in ikus060/rdiffweb

Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3301

Improper Cleanup on Thrown Exception in ikus060/rdiffweb

Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3272

Improper Handling of Length Parameter Inconsistency in ikus060/rdiffweb

Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3298

Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3292

Use of Cache Containing Sensitive Information in ikus060/rdiffweb

Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3326

Weak Password Requirements in ikus060/rdiffweb

Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3364

No limit in length of "Fullname" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffweb

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3371

No limit in length of "Token name" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffweb

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2022-3456

Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb