Vulnerability-Lookup - Search a vulnerability

CVE-2024-54852 (GCVE-0-2024-54852)

Vulnerability from cvelistv5

Published

2025-01-29 00:00

Modified

2025-02-10 22:11

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

n/a

Summary

When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords.

References

▼	URL	Tags
	https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-54852",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-03T18:22:15.775150Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-90",
                "description": "CWE-90 Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T22:11:34.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-29T21:27:43.679Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-54852",
    "datePublished": "2025-01-29T00:00:00.000Z",
    "dateReserved": "2024-12-06T00:00:00.000Z",
    "dateUpdated": "2025-02-10T22:11:34.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-46278 (GCVE-0-2024-46278)

Vulnerability from cvelistv5

Published

2024-10-07 00:00

Modified

2024-10-07 19:26

Severity ?

8.4 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

CWE

n/a

Summary

Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.

References

▼	URL	Tags
	https://github.com/ayato-shitomi/teedy_1.11_account-takeover
	https://github.com/ayato-shitomi/CVE-2024-46278-teedy_1.11_account-takeover

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sismics:teedy:1.11:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teedy",
            "vendor": "sismics",
            "versions": [
              {
                "status": "affected",
                "version": "1.11"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-46278",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-07T19:25:58.680953Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-07T19:26:36.193Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-07T16:06:09.478453",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/ayato-shitomi/teedy_1.11_account-takeover"
        },
        {
          "url": "https://github.com/ayato-shitomi/CVE-2024-46278-teedy_1.11_account-takeover"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-46278",
    "datePublished": "2024-10-07T00:00:00",
    "dateReserved": "2024-09-11T00:00:00",
    "dateUpdated": "2024-10-07T19:26:36.193Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-22115 (GCVE-0-2022-22115)

Vulnerability from cvelistv5

Published

2022-01-10 15:26

Modified

2024-09-17 03:28

Severity ?

9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-79 - Cross-site Scripting (XSS)

Summary

In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in the name of the Tag. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, and privileges escalation.

References

▼	URL	Tags
	https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c	x_refsource_MISC
	https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22115	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	sismics	docs	Version: v1.5 < unspecified Version: unspecified <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:00:55.278Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22115"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "docs",
          "vendor": "sismics",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "v1.5",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "v1.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "WhiteSource Vulnerability Research Team (WVR)"
        }
      ],
      "datePublic": "2022-01-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in the name of the Tag. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, and privileges escalation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-01-10T15:26:56",
        "orgId": "478c68dd-22c1-4a41-97cd-654224dfacff",
        "shortName": "Mend"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22115"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update to Teedy v1.10"
        }
      ],
      "source": {
        "advisory": "https://www.whitesourcesoftware.com/vulnerability-database/",
        "discovery": "UNKNOWN"
      },
      "title": "Teedy - Stored Cross-Site Scripting (XSS) in Tag Name",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vulnerabilitylab@whitesourcesoftware.com",
          "DATE_PUBLIC": "2022-01-04T22:00:00.000Z",
          "ID": "CVE-2022-22115",
          "STATE": "PUBLIC",
          "TITLE": "Teedy - Stored Cross-Site Scripting (XSS) in Tag Name"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "docs",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "v1.5"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "v1.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "sismics"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "WhiteSource Vulnerability Research Team (WVR)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in the name of the Tag. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, and privileges escalation."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c",
              "refsource": "MISC",
              "url": "https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c"
            },
            {
              "name": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22115",
              "refsource": "MISC",
              "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22115"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update to Teedy v1.10"
          }
        ],
        "source": {
          "advisory": "https://www.whitesourcesoftware.com/vulnerability-database/",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "478c68dd-22c1-4a41-97cd-654224dfacff",
    "assignerShortName": "Mend",
    "cveId": "CVE-2022-22115",
    "datePublished": "2022-01-10T15:26:56.337833Z",
    "dateReserved": "2021-12-21T00:00:00",
    "dateUpdated": "2024-09-17T03:28:07.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-22114 (GCVE-0-2022-22114)

Vulnerability from cvelistv5

Published

2022-01-10 15:26

Modified

2024-09-16 19:36

Severity ?

9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-79 - Cross-site Scripting (XSS)

Summary

In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The “search term" search functionality is not sufficiently sanitized while displaying the results of the search, which can be leveraged to inject arbitrary scripts. These scripts are executed in a victim’s browser when they enter the crafted URL. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, by an unauthenticated attacker.

References

▼	URL	Tags
	https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c	x_refsource_MISC
	https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	sismics	docs	Version: v1.5 < unspecified Version: unspecified <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:00:55.225Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "docs",
          "vendor": "sismics",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "v1.5",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "v1.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "WhiteSource Vulnerability Research Team (WVR)"
        }
      ],
      "datePublic": "2022-01-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The \u201csearch term\" search functionality is not sufficiently sanitized while displaying the results of the search, which can be leveraged to inject arbitrary scripts. These scripts are executed in a victim\u2019s browser when they enter the crafted URL. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, by an unauthenticated attacker."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-01-10T15:26:54",
        "orgId": "478c68dd-22c1-4a41-97cd-654224dfacff",
        "shortName": "Mend"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update to Teedy v1.10"
        }
      ],
      "source": {
        "advisory": "https://www.whitesourcesoftware.com/vulnerability-database/",
        "discovery": "UNKNOWN"
      },
      "title": "Teedy - Reflected Cross-Site Scripting (XSS) in the Search Functionality",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vulnerabilitylab@whitesourcesoftware.com",
          "DATE_PUBLIC": "2022-01-04T22:00:00.000Z",
          "ID": "CVE-2022-22114",
          "STATE": "PUBLIC",
          "TITLE": "Teedy - Reflected Cross-Site Scripting (XSS) in the Search Functionality"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "docs",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "v1.5"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "v1.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "sismics"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "WhiteSource Vulnerability Research Team (WVR)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The \u201csearch term\" search functionality is not sufficiently sanitized while displaying the results of the search, which can be leveraged to inject arbitrary scripts. These scripts are executed in a victim\u2019s browser when they enter the crafted URL. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, by an unauthenticated attacker."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c",
              "refsource": "MISC",
              "url": "https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c"
            },
            {
              "name": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114",
              "refsource": "MISC",
              "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update to Teedy v1.10"
          }
        ],
        "source": {
          "advisory": "https://www.whitesourcesoftware.com/vulnerability-database/",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "478c68dd-22c1-4a41-97cd-654224dfacff",
    "assignerShortName": "Mend",
    "cveId": "CVE-2022-22114",
    "datePublished": "2022-01-10T15:26:54.681124Z",
    "dateReserved": "2021-12-21T00:00:00",
    "dateUpdated": "2024-09-16T19:36:11.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-54851 (GCVE-0-2024-54851)

Vulnerability from cvelistv5

Published

2025-01-29 00:00

Modified

2025-01-30 16:48

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

n/a

Summary

Teedy <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection.

References

▼	URL	Tags
	https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54851/README.md

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-54851",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-30T16:46:32.870034Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-352",
                "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-30T16:48:20.198Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Teedy \u003c= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-29T21:25:46.715Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54851/README.md"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-54851",
    "datePublished": "2025-01-29T00:00:00.000Z",
    "dateReserved": "2024-12-06T00:00:00.000Z",
    "dateUpdated": "2025-01-30T16:48:20.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-22963 (GCVE-0-2025-22963)

Vulnerability from cvelistv5

Published

2025-01-13 00:00

Modified

2025-08-12 13:27

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Summary

Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.

References

▼	URL	Tags
	https://github.com/sota70/teedy-v1.11-csrf
	https://blog.teedy.io/
	https://github.com/sismics/docs/releases/tag/v1.11
	https://github.com/samplev45/CVE-2025-22963

Impacted products

	Vendor	Product	Version
	Sismics	Teedy	Version: 0 <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22963",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-13T17:37:25.307031Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-12T13:27:52.613Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Teedy",
          "vendor": "Sismics",
          "versions": [
            {
              "lessThanOrEqual": "1.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sismics:teedy:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-08T14:07:42.542Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/sota70/teedy-v1.11-csrf"
        },
        {
          "url": "https://blog.teedy.io/"
        },
        {
          "url": "https://github.com/sismics/docs/releases/tag/v1.11"
        },
        {
          "url": "https://github.com/samplev45/CVE-2025-22963"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-22963",
    "datePublished": "2025-01-13T00:00:00.000Z",
    "dateReserved": "2025-01-09T00:00:00.000Z",
    "dateUpdated": "2025-08-12T13:27:52.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-4892 (GCVE-0-2023-4892)

Vulnerability from cvelistv5

Published

2023-09-25 15:55

Modified

2024-09-24 14:58

Severity ?

5.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary

Teedy v1.11 has a vulnerability in its text editor that allows events to be executed in HTML tags that an attacker could manipulate. Thanks to this, it is possible to execute malicious JavaScript in the webapp.

References

▼	URL	Tags
	https://fluidattacks.com/advisories/freebird
	https://teedy.io

Impacted products

	Vendor	Product	Version
	Teedy	Teedy	Version: 1.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:38:00.898Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://fluidattacks.com/advisories/freebird"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://teedy.io"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-4892",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T14:58:17.505740Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T14:58:29.451Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "Teedy",
          "vendor": "Teedy",
          "versions": [
            {
              "status": "affected",
              "version": "1.11"
            }
          ]
        }
      ],
      "datePublic": "2023-09-25T15:53:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eTeedy v1.11 has a vulnerability in its text editor that allows events\u003c/div\u003e\u003cdiv\u003eto be executed in HTML tags that an attacker could manipulate. Thanks\u003c/div\u003e\u003cdiv\u003eto this, it is possible to execute malicious JavaScript in the webapp.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "Teedy v1.11 has a vulnerability in its text editor that allows events\n\nto be executed in HTML tags that an attacker could manipulate. Thanks\n\nto this, it is possible to execute malicious JavaScript in the webapp.\n\n\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-25T15:55:35.816Z",
        "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
        "shortName": "Fluid Attacks"
      },
      "references": [
        {
          "url": "https://fluidattacks.com/advisories/freebird"
        },
        {
          "url": "https://teedy.io"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Teedy v1.11 - Stored cross-site scripting (XSS)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
    "assignerShortName": "Fluid Attacks",
    "cveId": "CVE-2023-4892",
    "datePublished": "2023-09-25T15:55:35.816Z",
    "dateReserved": "2023-09-11T13:23:29.875Z",
    "dateUpdated": "2024-09-24T14:58:29.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd

Published

2022-01-10 16:15

Modified

2024-11-21 06:46

Severity ?

9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Summary

In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in the name of the Tag. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, and privileges escalation.

References

URL	Tags
vulnerabilitylab@mend.io	https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c	Patch, Third Party Advisory
vulnerabilitylab@mend.io	https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22115	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22115	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	sismics	teedy	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sismics:teedy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C76A96EC-CC57-4CEC-82B5-C11EED7DEB85",
              "versionEndIncluding": "1.9",
              "versionStartIncluding": "1.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in the name of the Tag. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, and privileges escalation."
    },
    {
      "lang": "es",
      "value": "En Teedy, versiones v1.5 hasta v1.9, son vulnerables a un ataque de tipo Cross-Site Scripting (XSS) Almacenado, en el nombre de una etiqueta creada. Dado que el nombre de la etiqueta no est\u00e1 siendo saneado correctamente en la p\u00e1gina de edici\u00f3n de la etiqueta, un atacante con pocos privilegios puede almacenar scripts maliciosos en el nombre de la etiqueta. En el peor de los casos, la v\u00edctima que desencadena inadvertidamente el ataque es un administrador con altos privilegios. Los scripts inyectados pueden extraer el ID de la sesi\u00f3n, lo que puede conllevar a una toma de posesi\u00f3n completa de la cuenta del administrador, y una escalada de privilegios"
    }
  ],
  "id": "CVE-2022-22115",
  "lastModified": "2024-11-21T06:46:12.853",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "vulnerabilitylab@mend.io",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-01-10T16:15:09.993",
  "references": [
    {
      "source": "vulnerabilitylab@mend.io",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c"
    },
    {
      "source": "vulnerabilitylab@mend.io",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22115"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22115"
    }
  ],
  "sourceIdentifier": "vulnerabilitylab@mend.io",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "vulnerabilitylab@mend.io",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2025-01-29 22:15

Modified

2025-05-23 15:23

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

Teedy <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection.

References

▼	URL	Tags
	cve@mitre.org	https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54851/README.md	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	sismics	teedy	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sismics:teedy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "031994E2-886B-4DE8-A449-66CD6891368D",
              "versionEndIncluding": "1.12",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Teedy \u003c= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection."
    },
    {
      "lang": "es",
      "value": "Teedy \u0026lt;= 1.12 es vulnerable a Cross Site Request Forgery (CSRF), debido a la falta de protecci\u00f3n CSRF."
    }
  ],
  "id": "CVE-2024-54851",
  "lastModified": "2025-05-23T15:23:24.140",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-01-29T22:15:29.627",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54851/README.md"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2023-09-25 16:15

Modified

2024-11-21 08:36

Severity ?

5.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
4.6 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Summary

Teedy v1.11 has a vulnerability in its text editor that allows events to be executed in HTML tags that an attacker could manipulate. Thanks to this, it is possible to execute malicious JavaScript in the webapp.

References

URL	Tags
help@fluidattacks.com	https://fluidattacks.com/advisories/freebird	Exploit, Third Party Advisory
help@fluidattacks.com	https://teedy.io	Product
af854a3a-2127-422b-91ae-364da2661108	https://fluidattacks.com/advisories/freebird	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://teedy.io	Product

Impacted products

	Vendor	Product	Version
	sismics	teedy	1.11

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sismics:teedy:1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB7008DF-9901-48D2-9079-D4F89F4E810E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Teedy v1.11 has a vulnerability in its text editor that allows events\n\nto be executed in HTML tags that an attacker could manipulate. Thanks\n\nto this, it is possible to execute malicious JavaScript in the webapp.\n\n\n\n"
    },
    {
      "lang": "es",
      "value": "Teedy v1.11 tiene una vulnerabilidad en su editor de texto que permite ejecutar eventos en etiquetas HTML que un atacante podr\u00eda manipular. Gracias a esto, es posible ejecutar JavaScript malicioso en la aplicaci\u00f3n web.\n"
    }
  ],
  "id": "CVE-2023-4892",
  "lastModified": "2024-11-21T08:36:12.260",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 3.6,
        "source": "help@fluidattacks.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-09-25T16:15:15.530",
  "references": [
    {
      "source": "help@fluidattacks.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://fluidattacks.com/advisories/freebird"
    },
    {
      "source": "help@fluidattacks.com",
      "tags": [
        "Product"
      ],
      "url": "https://teedy.io"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://fluidattacks.com/advisories/freebird"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://teedy.io"
    }
  ],
  "sourceIdentifier": "help@fluidattacks.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "help@fluidattacks.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2022-01-10 16:15

Modified

2024-11-21 06:46

Severity ?

9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Summary

In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The “search term" search functionality is not sufficiently sanitized while displaying the results of the search, which can be leveraged to inject arbitrary scripts. These scripts are executed in a victim’s browser when they enter the crafted URL. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, by an unauthenticated attacker.

References

URL	Tags
vulnerabilitylab@mend.io	https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c	Patch, Third Party Advisory
vulnerabilitylab@mend.io	https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	sismics	teedy	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sismics:teedy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C76A96EC-CC57-4CEC-82B5-C11EED7DEB85",
              "versionEndIncluding": "1.9",
              "versionStartIncluding": "1.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The \u201csearch term\" search functionality is not sufficiently sanitized while displaying the results of the search, which can be leveraged to inject arbitrary scripts. These scripts are executed in a victim\u2019s browser when they enter the crafted URL. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, by an unauthenticated attacker."
    },
    {
      "lang": "es",
      "value": "En Teedy, versiones v1.5 hasta v1.9, son vulnerables a un ataque de tipo Cross-Site Scripting (XSS) Reflejado. La funcionalidad de b\u00fasqueda  \u201csearch term\" no est\u00e1 suficientemente saneada mientras son mostrados los resultados de la b\u00fasqueda, lo que puede ser aprovechado para inyectar scripts arbitrarios. Estos scripts son ejecutados en el navegador de la v\u00edctima cuando entra en la URL dise\u00f1ada. En el peor de los casos, la v\u00edctima que desencadena inadvertidamente el ataque es un administrador con altos privilegios. Los scripts inyectados pueden extraer el ID de la sesi\u00f3n, lo que puede conllevar a una toma de control total de la cuenta del administrador, por parte de un atacante no autenticado"
    }
  ],
  "id": "CVE-2022-22114",
  "lastModified": "2024-11-21T06:46:12.697",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "vulnerabilitylab@mend.io",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-01-10T16:15:09.920",
  "references": [
    {
      "source": "vulnerabilitylab@mend.io",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c"
    },
    {
      "source": "vulnerabilitylab@mend.io",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114"
    }
  ],
  "sourceIdentifier": "vulnerabilitylab@mend.io",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "vulnerabilitylab@mend.io",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2025-01-29 22:15

Modified

2025-05-24 01:14

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords.

References

▼	URL	Tags
	cve@mitre.org	https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md	Exploit, Third Party Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	sismics	teedy	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sismics:teedy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A8D78C9-F89D-420E-BBF4-F2C76E114ECF",
              "versionEndIncluding": "1.12",
              "versionStartIncluding": "1.9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords."
    },
    {
      "lang": "es",
      "value": "Cuando se activa la conexi\u00f3n LDAP en las versiones de Teedy entre 1.9 y 1.12, el campo de nombre de usuario del formulario de inicio de sesi\u00f3n es vulnerable a la inyecci\u00f3n LDAP. Debido a la introducci\u00f3n incorrecta de desinfecci\u00f3n en la entrada del usuario, un atacante no autenticado puede realizar varias acciones maliciosas, como crear cuentas arbitrarias y difundir contrase\u00f1as."
    }
  ],
  "id": "CVE-2024-54852",
  "lastModified": "2025-05-24T01:14:43.543",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-01-29T22:15:29.723",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-90"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2024-10-07 16:15

Modified

2025-06-04 17:08

Severity ?

8.4 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Summary

Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.

References

▼	URL	Tags
	cve@mitre.org	https://github.com/ayato-shitomi/CVE-2024-46278-teedy_1.11_account-takeover	Exploit, Third Party Advisory
	cve@mitre.org	https://github.com/ayato-shitomi/teedy_1.11_account-takeover	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	sismics	teedy	1.11

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sismics:teedy:1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB7008DF-9901-48D2-9079-D4F89F4E810E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console."
    },
    {
      "lang": "es",
      "value": "Teedy 1.11 es vulnerable a Cross Site Scripting (XSS) a trav\u00e9s de la consola de administraci\u00f3n."
    }
  ],
  "id": "CVE-2024-46278",
  "lastModified": "2025-06-04T17:08:35.510",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 6.0,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-10-07T16:15:05.547",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ayato-shitomi/CVE-2024-46278-teedy_1.11_account-takeover"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ayato-shitomi/teedy_1.11_account-takeover"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

Vulnerabilites related to Sismics - Teedy

CVE-2024-54852 (GCVE-0-2024-54852)

Vulnerability from cvelistv5

CVE-2024-46278 (GCVE-0-2024-46278)

Vulnerability from cvelistv5

CVE-2022-22115 (GCVE-0-2022-22115)

Vulnerability from cvelistv5

CVE-2022-22114 (GCVE-0-2022-22114)

Vulnerability from cvelistv5

CVE-2024-54851 (GCVE-0-2024-54851)

Vulnerability from cvelistv5

CVE-2025-22963 (GCVE-0-2025-22963)

Vulnerability from cvelistv5

CVE-2023-4892 (GCVE-0-2023-4892)

Vulnerability from cvelistv5

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd