CVSS: 8.2EPSS: 0%CPEs: 10EXPL: 0CVE-2024-21545
https://notcve.org/view.php?id=CVE-2024-21545
24 Sep 2024 — Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response values allow authenticated attackers with 'Sys.Audit' or 'VM.Monitor' privileges to download arbitrary host files via the API. When handling the result from a request handler before returning it to the user, the handle_api2_request function will check for the ‘download’ or ‘data’->’download’ objects inside the request handler call response object. If ... • https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/post-705345 • CWE-73: External Control of File Name or Path •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46854
https://notcve.org/view.php?id=CVE-2023-46854
28 Oct 2023 — Proxmox proxmox-widget-toolkit before 4.0.9, as used in multiple Proxmox products, allows XSS via the edit notes feature. Proxmox proxmox-widget-toolkit anterior a 4.0.9, como se usa en múltiples productos Proxmox, permite XSS a través de la función de edición de notas. • https://git.proxmox.com/?p=proxmox-widget-toolkit.git%3Ba=commit%3Bh=1326f771b959e576d140da2249c8b5424da6c80d • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-43320 – Proxmox VE 7.4-1 TOTP Brute Force
https://notcve.org/view.php?id=CVE-2023-43320
27 Sep 2023 — An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to escalate privileges via bypassing the two-factor authentication component. Un problema en Proxmox Server Solutions GmbH Proxmox VE v.5.4 hasta v.8.0, Proxmox Backup Server v.1.1 hasta v.3.0 y Proxmox Mail Gateway v.7.1 hasta v.8.0 permite a un atacante autenticado remoto escalar privilegios evitando el Componente de... • http://packetstormsecurity.com/files/176967/Proxmox-VE-7.4-1-TOTP-Brute-Force.html •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-31358
https://notcve.org/view.php?id=CVE-2022-31358
14 Dec 2022 — A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/. Una vulnerabilidad de cross site scripting (XSS) reflejado en Proxmox Virtual Environment anterior a v7.2-3 permite a atacantes remotos ejecutar scripts web o HTML de su elección a través de endpoints inexistentes en la ruta /api2/html/. • http://proxmox.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2022-35508
https://notcve.org/view.php?id=CVE-2022-35508
04 Dec 2022 — Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox Mail Gateway, privilege escalation to the root@pam account is possible if the backup feature has ever been used, because backup files such as pmg-backup_YYYY_MM_DD_*.tgz have 0644 permissions and contain an... • https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=580d540ea907ba15f64379c5bb69ecf1a49a875f • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 1CVE-2022-35507
https://notcve.org/view.php?id=CVE-2022-35507
04 Dec 2022 — A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3. Una vulnerabilidad de inyección CRLF de encabezado de respuesta en la interfaz web Proxmox Virtual Environment (... • https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=936007ae0241811093155000486da171379c23c2 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4156
https://notcve.org/view.php?id=CVE-2014-4156
27 Jan 2020 — Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability Proxmox VE versiones anteriores a 3.2: Vulnerabilidad de Enumeración de Usuario de "AccessControl.pm". • http://www.openwall.com/lists/oss-security/2014/06/17/16 • CWE-203: Observable Discrepancy •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2015-9058
https://notcve.org/view.php?id=CVE-2015-9058
03 May 2017 — Open redirect vulnerability in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter. La vulnerabilidad de redirección abierta en Proxmox Mail Gateway anteriores a la versión4.0-8-097d26a9 permite a atacantes remotos redirigir a los usuarios a sitios web arbitrarios y realizar ataques de phishing a través del parámetro destination. • https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-024/?fid=7431 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2015-9057
https://notcve.org/view.php?id=CVE-2015-9057
03 May 2017 — Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allow remote attackers to inject arbitrary web script or HTML via multiple parameters, related to /users/index.htm, /quarantine/spam/manage.htm, /quarantine/spam/whitelist.htm, /queues/mail/index/, /system/ssh.htm, /queues/mail/?domain=, and /quarantine/virus/manage.htm. Múltiples vulnerabilidades de XSS en Proxmox Mail Gateway anterior al hotfix 4.0-8-097d26a9 permiten a atacantes remotos inyectar sec... • https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-024/?fid=7431 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 2CVE-2014-2325
https://notcve.org/view.php?id=CVE-2014-2325
14 Mar 2014 — Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the (1) state parameter to objects/who/index.htm or (2) User email address to quarantine/spam/manage.htm. Múltiples vulnerabilidades de XSS en Proxmox Mail Gateway anterior a 3.1-5829 permiten a atacantes remotos inyectar script Web o HTML arbitrarios a través del (1) parámetro state hacia objects/who/index.htm o (2) dirección de email de usuario hacia... • http://proxmox.com/news/archive/view/listid-1-proxmox-newsletter/mailid-48-proxmox-newsletter-march-2014-proxmox-ve-3-2-released/tmpl-component • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •