CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2258 – Improper Neutralization of Formula Elements in a CSV File in alfio-event/alf.io
https://notcve.org/view.php?id=CVE-2023-2258
24 Apr 2023 — Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304. • https://github.com/alfio-event/alf.io/commit/94e2923a317452e337393789c9f3192dfc1ddac2 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2259 – Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io
https://notcve.org/view.php?id=CVE-2023-2259
24 Apr 2023 — Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304. • https://github.com/alfio-event/alf.io/commit/94e2923a317452e337393789c9f3192dfc1ddac2 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2260 – Authorization Bypass Through User-Controlled Key in alfio-event/alf.io
https://notcve.org/view.php?id=CVE-2023-2260
24 Apr 2023 — Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304. • https://github.com/alfio-event/alf.io/commit/c9a16ab93d42b2beb06d529b57890121f85be6ef • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-25577
https://notcve.org/view.php?id=CVE-2022-25577
25 Mar 2022 — ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data. Attackers who are able to gain remote or local access to the system are able to read and modify the data. Se ha detectado que ALF-BanCO versiones v8.2.5 y anteriores, usa una contraseña embebida para cifrar la base de datos SQLite que contiene los datos del usuario. Los atacantes que pueden conseguir acceso remoto o local al sistema pueden leer y modificar los datos • https://github.com/ph0nkybit/proof-of-concepts/tree/main/Use_Of_Hardcoded_Password_In_ALF-BanCO_8.2.x • CWE-798: Use of Hard-coded Credentials •