Raneto vulnerable to Cross-site Scripting

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-35144 · ADVISORY
• ryanlelek/Raneto#370 · WEB
• cwe.mitre.org/data/definitions/79.html · WEB
• gainsec.com/2022/08/04/cve-2022-35142-cve-2022-35143-cve-2022-35144 · WEB
• ryanlelek/Raneto · PACKAGE
• ryanlelek/Raneto release 0.17.1 · WEB
• raneto.com · WEB
• raneto.com · Product
• gainsec.com/2022/08/04/cve-2022-35142-cve-2022-35143-cve-2022-35144 · Exploit
• gilbitron/Raneto release · Release Notes

raneto のその他の脆弱性

• CVE-2022-35143緊急 9.8Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.
• CVE-2022-35142高 7.5An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.