CVE-2020-25787

Mô tả

Tham khảo

• packetstormsecurity.com/files/161606/TinyTinyRSS-Remote-Code-Execution.html · Exploit
• blog.neagaru.com/p/exploiting-tiny-tiny-rss-2020
• community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799 · Vendor Advisory
• git.tt-rss.org/fox/tt-rss/commit/c3d14e1fa54c7dade7b1b7955575e2991396d7ef · Patch

Lỗ hổng khác của tiny tiny rss

• CVE-2021-28373CAO 7.5The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the OTP code without a valid passw…
• CVE-2020-25789TRUNG BÌNH 6.1An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. The cached_url feature mishandles JavaScript inside an SVG document…
• CVE-2020-25788CAO 8.1An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["ur…
• CVE-2017-16896NGHIÊM TRỌNG 9.8A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the login parameter.