CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23074 – Recipes - Stored XSS in Name Parameter
https://notcve.org/view.php?id=CVE-2022-23074
21 Jun 2022 — In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover. En Recipes, versiones 0.17.0 hasta 1.2.5, son vulnerables a un ataque de tipo Cross-Site Scripting (XSS) Almacenado, en el campo "Name" de los componentes Keyword, Food y Uni... • https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23073 – Recipes - Stored XSS in Clipboard
https://notcve.org/view.php?id=CVE-2022-23073
21 Jun 2022 — In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the clipboard icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover. En Recipes, versiones 1.0.5 hasta 1.2.5, son vulnerables a un ataque de tipo Cross-Site Scriptin... • https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23072 – Recipes - Stored XSS in Add to Cart
https://notcve.org/view.php?id=CVE-2022-23072
21 Jun 2022 — In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover. En Recipes, versiones 1.0.5 hasta 1.2.5, son vulnerables a un ataque de tipo Cross-Site S... • https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23071 – Recipes - SSRF on Import
https://notcve.org/view.php?id=CVE-2022-23071
19 Jun 2022 — In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information. En Recipes, versiones 0.9.1 hasta 1.2.5, son vulnerables a un ataque de tipo Server Side Request Forgery (SSRF), en la funcionalidad “Import Recipe”. Cuando un atacante entra en la URL de localhost, un atacante con pocos privilegios pue... • https://github.com/TandoorRecipes/recipes/commit/d48fe26a3529cc1ee903ffb2758dfd8f7efaba8c • CWE-918: Server-Side Request Forgery (SSRF) •