Search criteria
18 vulnerabilities found for tryton by tryton
FKIE_CVE-2018-19443
Vulnerability from fkie_nvd - Published: 2018-11-22 19:29 - Updated: 2024-11-21 03:57
Severity ?
Summary
The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | https://bugs.tryton.org/issue7792 | Issue Tracking, Third Party Advisory | |
| cve@mitre.org | https://discuss.tryton.org/t/security-release-for-issue7792/830 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugs.tryton.org/issue7792 | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://discuss.tryton.org/t/security-release-for-issue7792/830 | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8B163CF2-F5E0-4250-92BA-3BE11D2882B0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle."
},
{
"lang": "es",
"value": "El cliente en Tryton, en versiones 5.x anteriores a la 5.0.1, intenta establecer una conexi\u00f3n con el bus en texto claro en vez de cifrado bajo ciertas circunstancias en bus.py y jsonrpc.py. El intento de conexi\u00f3n falla, pero contiene la sesi\u00f3n actual del usuario en la cabecera. Dicha sesi\u00f3n podr\u00eda ser robada por un atacante Man-in-the-Middle (MitM)."
}
],
"id": "CVE-2018-19443",
"lastModified": "2024-11-21T03:57:55.777",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-11-22T19:29:00.220",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugs.tryton.org/issue7792"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://discuss.tryton.org/t/security-release-for-issue7792/830"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugs.tryton.org/issue7792"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://discuss.tryton.org/t/security-release-for-issue7792/830"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-384"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2014-6633
Vulnerability from fkie_nvd - Published: 2018-04-12 15:29 - Updated: 2024-11-21 02:14
Severity ?
Summary
The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2DF36628-2D5D-4EE0-93F5-16163985580C",
"versionEndExcluding": "2.4.15",
"versionStartIncluding": "2.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F98B781C-15E8-450D-A1EE-495AC94FC310",
"versionEndExcluding": "2.6.14",
"versionStartIncluding": "2.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5A270A4A-9182-460F-B81C-17C4C4CF0331",
"versionEndExcluding": "2.8.11",
"versionStartIncluding": "2.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6D3295-0538-4F9E-8336-A3B825B6A0B3",
"versionEndExcluding": "3.0.7",
"versionStartIncluding": "3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B6962AFB-253E-4484-9152-D99A5EC7C742",
"versionEndExcluding": "3.2.3",
"versionStartIncluding": "3.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module."
},
{
"lang": "es",
"value": "La funci\u00f3n safe_eval en trytond en Tryton, en versiones anteriores a la 2.4.15, versiones 2.6.x anteriores a la 2.6.14, versiones 2.8.x anteriores a la 2.8.11, versiones 3.0.x anteriores a la 3.0.7 y versiones 3.2.x anteriores a la 3.2.3, permite que usuarios autenticados remotos ejecuten comandos arbitrarios mediante metacaracteres shell en (1) collection.domain en el m\u00f3dulo webdav o (2) el campo formula en el m\u00f3dulo price_list."
}
],
"id": "CVE-2014-6633",
"lastModified": "2024-11-21T02:14:50.687",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-12T15:29:00.287",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tryton.org/posts/security-release-for-issue4155.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking"
],
"url": "https://bugs.tryton.org/issue4155"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tryton.org/posts/security-release-for-issue4155.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking"
],
"url": "https://bugs.tryton.org/issue4155"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2017-0360
Vulnerability from fkie_nvd - Published: 2017-04-04 17:59 - Updated: 2025-04-20 01:37
Severity ?
Summary
file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9C3BE0CB-5798-440A-99EA-84CFC4C26051",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "24879289-85DC-47F3-B102-F5242F2F98D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E7C9AA44-EEE7-4FFB-818E-516FAF3BB935",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "8DFD995D-50CE-444D-BFD9-1FEDF8A337DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "587F99E7-1BB0-4D34-9CF4-2CD7CFAD9459",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "16539C74-95DC-417A-83AF-D9C2CB468D1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "99BE0FAF-878E-4413-9D4F-1D11E46E3FE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "5F213038-286C-4138-9E6A-2256D98FFE6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7CA5BB77-15D2-4DB3-B612-D2BA2F6B37A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "0409E1A5-D0B1-44D5-B997-6AEBE324B26B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "4069DF96-E8A8-4BE1-87CA-BB018511BB86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "494F67A7-92EE-4E37-878B-F7B248B47FF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A1D5CBC4-6BBF-4D40-95D3-079685D5CD54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "909F40C4-7FC8-452F-8C8F-7423D2BC1425",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "96B2D6AD-A9C5-4550-924D-421CA8C5661C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "19D3A96B-C26E-462A-ADB7-7E034EE49E4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "76AC5C00-C930-43EF-985A-573DF58BC0C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "D7CD69E0-EED5-44A7-93B5-FD0606405099",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E66CA992-A721-43C1-975E-13408D0BCC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7E9FEF0C-1832-48AE-8DA6-13B9DD5D0714",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C335C4A2-410B-4BCD-9885-E50FC97074DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D7F4A664-E6F7-406E-95B3-2DCB3C634DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "20AC1330-FD90-41E2-B8D4-C1FB3440ABC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B0FCDE6E-9B0D-4FAA-AA5F-B5DC55E83324",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A8CF2DAD-2DC2-4F7B-B9C2-55D0ECEC89CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71A8D4B9-3AEC-41B5-ACB7-F7BE58520174",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B618440C-15B0-4578-A590-9E72371B7C5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "5960FA55-5FAC-4E12-AC6C-01A62815B992",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F6DF0ACF-E916-439C-B818-CD6F756DBBB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "9D73CD6B-6C41-417C-ABE9-FDFEB7F9E7C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "901AB7CF-610F-43C9-A0D9-6F17D2F2EAFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "5BD395ED-F4B4-4413-B906-888532100F78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1F5A6EA0-898D-41A3-B2E9-A3E27C9130D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "9F93FFA0-1DE6-46AB-8FE3-200DC05DC53A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "090FF1F7-66F6-47B0-BB3C-98CED35A63B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "E073DC5B-C6EC-42DD-BFE0-CF166881B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCBACDA2-4A24-4E94-A97D-CE35BD2260DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D9F4CB60-AC83-4B8C-9378-DD3A0B073A83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "820DCFC1-B82D-4F9F-A9C2-00693BB4A0CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C1C780E6-F84E-4AF9-977E-A2355773C0AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D2D1D2EF-BDA5-45F8-AA65-829E388D60BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9F9C31E9-5A60-4CEE-BF09-DF1980BFFDCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "983F41DE-2696-480C-89BE-C8F9DC8F9DA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DA9BB6FB-98FE-4065-AE4F-49DE1FA82EDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "6C82B8CF-F5A9-47CA-B142-BF5615744F20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "38032178-B351-488D-8AFE-44B367331613",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "31F5A3E2-12F3-42AF-80B3-41AF54D4D668",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6D2C93-E66F-4A62-94C2-8A44C83FA3DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "CEABCB83-257F-4791-95C1-07B28C07E07B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "6331C335-1E73-4A58-B4D8-DD32E707DA82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "17112766-1580-4705-8CFD-25612431EDBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "66770DDE-3B3D-4B05-B36C-C1CE88673736",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.16:*:*:*:*:*:*:*",
"matchCriteriaId": "FFB9529D-CDD9-46DC-80D5-52CA49B22B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.17:*:*:*:*:*:*:*",
"matchCriteriaId": "20199A2F-13DE-4AA7-8469-2A817160038D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0A2E5ED5-1490-49C4-B484-97020B90E611",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0C55F574-5734-4131-B7FA-7C3B72A34366",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "785A1D6A-52BD-4EA0-9FEA-805F4CF8F347",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "982F55FA-230E-486D-857D-A47C5580A98A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3868F007-E794-47BA-A6C2-4D5572F607D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5569A138-B8A1-4782-9E21-8189C614A8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D53B70AD-3197-4BF3-A650-FE7932380FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "99CED877-4F45-4485-9890-00B65593223E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "67A47C56-D2BA-460A-B3AD-91BD830E31C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F1651341-2B35-48B5-8B51-9935260EFFEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6E60BF36-AD7B-4198-AF3E-72B62572D194",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "FFB2741E-31D0-4FE0-90FC-F9AFCDA60FA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5DA1B86C-6A53-444E-96A2-4AF29CE20C39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "DAA91581-4170-41C4-A55F-A5F93538A146",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "B7338242-710D-4AC3-8621-01CDC7CDD420",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.15:*:*:*:*:*:*:*",
"matchCriteriaId": "3D72CDA5-8581-4221-9B28-9AB040D5AF5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.16:*:*:*:*:*:*:*",
"matchCriteriaId": "85B7C654-09B0-49E1-B9F1-A4677706EA79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "618FF838-56E3-4087-AD2D-FE8677740400",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A90168D0-DADF-4AD2-81F6-10F5FC4BAB88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "78EB89CB-07F2-44AE-B99F-DAAC81FE7D86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "98756804-6B53-4BD0-89D0-573905D83B26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E82011DD-1E22-4969-BCFA-95FD9C995CCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "75573741-4CF9-4465-BED6-6C296754FB5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C02E22AF-5768-41CC-AF93-A4A1FCB22C89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2B471B78-0232-40A1-AD89-55FF000297FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.8:*:*:*:*:*:*:*",
"matchCriteriaId": "2E73FB76-3704-4D60-A9ED-DD412E4294BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.9:*:*:*:*:*:*:*",
"matchCriteriaId": "468B866F-AE51-42B0-906F-FDD5F7533141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.10:*:*:*:*:*:*:*",
"matchCriteriaId": "664D1CA5-7169-4E6D-AC41-DC867EDBA91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AB720FD3-6527-4081-8959-AAA85E275264",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.12:*:*:*:*:*:*:*",
"matchCriteriaId": "37E8E5EE-657A-415D-AE1C-DE725344E325",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.13:*:*:*:*:*:*:*",
"matchCriteriaId": "0C1138CC-3C59-45FB-BADF-A329B082ED22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.14:*:*:*:*:*:*:*",
"matchCriteriaId": "B8612F05-E1EF-4B5F-8E37-09506E84BAA6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6730B739-B7EF-495D-8256-F552FAAAB588",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F95728E5-B5C5-4C9D-807E-535726C9886B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "44C9A34B-FAC8-454C-8C87-908B3A5B54D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1C5A0CD6-9D95-4C6F-B566-5347391E87AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D81B3FD5-97E1-4621-A832-2E9AD79FE0B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "AFD46BD3-D489-43F1-ACDF-019533F1EFBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AC409228-5D3C-4612-B757-0440AA8AE4EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "64772E1F-9F56-4F13-BFBC-E21BB015DC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FE692AA6-C1BB-48A7-91EB-97B283306B5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "75737945-8A14-45E2-936E-CAF3ABA5F674",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "56A8D4C7-CDFF-437C-914A-69F05B5D1AD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C95F366-D7C0-4526-9F97-AC2A86E93BE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "258679B3-C370-4BF2-BA7F-E91285FE7988",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a \"same root name but with a suffix\" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242."
},
{
"lang": "es",
"value": "Archivo abierto en Tryton 3.x y 4.x hasta la versi\u00f3n 4.2.2 permite a los usuarios autenticados remotos con ciertos permisos leer archivos arbitrarios mediante un ataque de \"mismo nombre de ra\u00edz pero con sufijo\". NOTA: Esta vulnerabilidad existe debido a una correcci\u00f3n incompleta para CVE-2016-1242."
}
],
"id": "CVE-2017-0360",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.6,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-04-04T17:59:00.240",
"references": [
{
"source": "security@debian.org",
"url": "http://hg.tryton.org/trytond?cmd=changeset%3Bnode=472510fdc6f8"
},
{
"source": "security@debian.org",
"url": "http://www.debian.org/security/2017/dsa-3826"
},
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/97489"
},
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://hg.tryton.org/trytond?cmd=changeset%3Bnode=472510fdc6f8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2017/dsa-3826"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/97489"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-269"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2016-1242
Vulnerability from fkie_nvd - Published: 2016-09-07 19:28 - Updated: 2025-04-12 10:46
Severity ?
Summary
file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tryton | tryton | 4.0.0 | |
| tryton | tryton | 4.0.1 | |
| tryton | tryton | 4.0.2 | |
| tryton | tryton | 4.0.3 | |
| tryton | tryton | * | |
| tryton | tryton | 3.8.0 | |
| tryton | tryton | 3.8.1 | |
| tryton | tryton | 3.8.2 | |
| tryton | tryton | 3.8.3 | |
| tryton | tryton | 3.8.4 | |
| tryton | tryton | 3.8.5 | |
| tryton | tryton | 3.8.6 | |
| tryton | tryton | 3.8.7 | |
| tryton | tryton | 3.4.0 | |
| tryton | tryton | 3.4.1 | |
| tryton | tryton | 3.4.2 | |
| tryton | tryton | 3.4.3 | |
| tryton | tryton | 3.4.4 | |
| tryton | tryton | 3.4.5 | |
| tryton | tryton | 3.4.6 | |
| tryton | tryton | 3.4.7 | |
| tryton | tryton | 3.4.8 | |
| tryton | tryton | 3.4.9 | |
| tryton | tryton | 3.4.10 | |
| tryton | tryton | 3.4.11 | |
| tryton | tryton | 3.4.12 | |
| tryton | tryton | 3.4.13 | |
| tryton | tryton | 3.8.4 | |
| tryton | tryton | 3.2.0 | |
| tryton | tryton | 3.6.0 | |
| tryton | tryton | 3.6.1 | |
| tryton | tryton | 3.6.2 | |
| tryton | tryton | 3.6.3 | |
| tryton | tryton | 3.6.4 | |
| tryton | tryton | 3.6.5 | |
| tryton | tryton | 3.6.6 | |
| tryton | tryton | 3.6.7 | |
| tryton | tryton | 3.6.8 | |
| tryton | tryton | 3.6.9 | |
| tryton | tryton | 3.6.10 | |
| tryton | tryton | 3.6.11 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6730B739-B7EF-495D-8256-F552FAAAB588",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F95728E5-B5C5-4C9D-807E-535726C9886B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "44C9A34B-FAC8-454C-8C87-908B3A5B54D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1C5A0CD6-9D95-4C6F-B566-5347391E87AF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CF963655-95EE-47FF-AB6C-1C647D4C23E0",
"versionEndIncluding": "3.2.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "618FF838-56E3-4087-AD2D-FE8677740400",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A90168D0-DADF-4AD2-81F6-10F5FC4BAB88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "78EB89CB-07F2-44AE-B99F-DAAC81FE7D86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "98756804-6B53-4BD0-89D0-573905D83B26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E82011DD-1E22-4969-BCFA-95FD9C995CCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "75573741-4CF9-4465-BED6-6C296754FB5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C02E22AF-5768-41CC-AF93-A4A1FCB22C89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2B471B78-0232-40A1-AD89-55FF000297FF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCBACDA2-4A24-4E94-A97D-CE35BD2260DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D9F4CB60-AC83-4B8C-9378-DD3A0B073A83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "820DCFC1-B82D-4F9F-A9C2-00693BB4A0CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C1C780E6-F84E-4AF9-977E-A2355773C0AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D2D1D2EF-BDA5-45F8-AA65-829E388D60BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9F9C31E9-5A60-4CEE-BF09-DF1980BFFDCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "983F41DE-2696-480C-89BE-C8F9DC8F9DA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DA9BB6FB-98FE-4065-AE4F-49DE1FA82EDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "6C82B8CF-F5A9-47CA-B142-BF5615744F20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "38032178-B351-488D-8AFE-44B367331613",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "31F5A3E2-12F3-42AF-80B3-41AF54D4D668",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6D2C93-E66F-4A62-94C2-8A44C83FA3DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "CEABCB83-257F-4791-95C1-07B28C07E07B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "6331C335-1E73-4A58-B4D8-DD32E707DA82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E82011DD-1E22-4969-BCFA-95FD9C995CCE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E66CA992-A721-43C1-975E-13408D0BCC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0A2E5ED5-1490-49C4-B484-97020B90E611",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0C55F574-5734-4131-B7FA-7C3B72A34366",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "785A1D6A-52BD-4EA0-9FEA-805F4CF8F347",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "982F55FA-230E-486D-857D-A47C5580A98A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3868F007-E794-47BA-A6C2-4D5572F607D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5569A138-B8A1-4782-9E21-8189C614A8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D53B70AD-3197-4BF3-A650-FE7932380FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "99CED877-4F45-4485-9890-00B65593223E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "67A47C56-D2BA-460A-B3AD-91BD830E31C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F1651341-2B35-48B5-8B51-9935260EFFEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6E60BF36-AD7B-4198-AF3E-72B62572D194",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "FFB2741E-31D0-4FE0-90FC-F9AFCDA60FA3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors."
},
{
"lang": "es",
"value": "file_open en Tryton en versiones anteriores a 3.2.17, 3.4.x en versiones anteriores a 3.4.14, 3.6.x en versiones anteriores a 3.6.12, 3.8.x en versiones anteriores a 3.8.8 y 4.x en versiones anteriores a 4.0.4 permite a usuarios remotos autenticados con ciertos permisos leer archivos arbitrarios a trav\u00e9s del par\u00e1metro name o de otros vectores no especificados."
}
],
"id": "CVE-2016-1242",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 0.7,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-09-07T19:28:01.677",
"references": [
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3656"
},
{
"source": "security@debian.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking"
],
"url": "https://bugs.tryton.org/issue5808"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3656"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking"
],
"url": "https://bugs.tryton.org/issue5808"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2016-1241
Vulnerability from fkie_nvd - Published: 2016-09-07 19:28 - Updated: 2025-04-12 10:46
Severity ?
Summary
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tryton | tryton | 3.8.0 | |
| tryton | tryton | 3.8.1 | |
| tryton | tryton | 3.8.2 | |
| tryton | tryton | 3.8.3 | |
| tryton | tryton | 3.8.4 | |
| tryton | tryton | 3.8.5 | |
| tryton | tryton | 3.8.6 | |
| tryton | tryton | 3.8.7 | |
| tryton | tryton | 4.0.0 | |
| tryton | tryton | 4.0.1 | |
| tryton | tryton | 4.0.2 | |
| tryton | tryton | 4.0.3 | |
| tryton | tryton | * | |
| tryton | tryton | 3.2.0 | |
| tryton | tryton | 3.6.0 | |
| tryton | tryton | 3.6.1 | |
| tryton | tryton | 3.6.2 | |
| tryton | tryton | 3.6.3 | |
| tryton | tryton | 3.6.4 | |
| tryton | tryton | 3.6.5 | |
| tryton | tryton | 3.6.6 | |
| tryton | tryton | 3.6.7 | |
| tryton | tryton | 3.6.8 | |
| tryton | tryton | 3.6.9 | |
| tryton | tryton | 3.6.10 | |
| tryton | tryton | 3.6.11 | |
| tryton | tryton | 3.4.0 | |
| tryton | tryton | 3.4.1 | |
| tryton | tryton | 3.4.2 | |
| tryton | tryton | 3.4.3 | |
| tryton | tryton | 3.4.4 | |
| tryton | tryton | 3.4.5 | |
| tryton | tryton | 3.4.6 | |
| tryton | tryton | 3.4.7 | |
| tryton | tryton | 3.4.8 | |
| tryton | tryton | 3.4.9 | |
| tryton | tryton | 3.4.10 | |
| tryton | tryton | 3.4.11 | |
| tryton | tryton | 3.4.12 | |
| tryton | tryton | 3.4.13 | |
| tryton | tryton | 3.8.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "618FF838-56E3-4087-AD2D-FE8677740400",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A90168D0-DADF-4AD2-81F6-10F5FC4BAB88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "78EB89CB-07F2-44AE-B99F-DAAC81FE7D86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "98756804-6B53-4BD0-89D0-573905D83B26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E82011DD-1E22-4969-BCFA-95FD9C995CCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "75573741-4CF9-4465-BED6-6C296754FB5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C02E22AF-5768-41CC-AF93-A4A1FCB22C89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2B471B78-0232-40A1-AD89-55FF000297FF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6730B739-B7EF-495D-8256-F552FAAAB588",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F95728E5-B5C5-4C9D-807E-535726C9886B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "44C9A34B-FAC8-454C-8C87-908B3A5B54D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1C5A0CD6-9D95-4C6F-B566-5347391E87AF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CF963655-95EE-47FF-AB6C-1C647D4C23E0",
"versionEndIncluding": "3.2.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E66CA992-A721-43C1-975E-13408D0BCC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0A2E5ED5-1490-49C4-B484-97020B90E611",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0C55F574-5734-4131-B7FA-7C3B72A34366",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "785A1D6A-52BD-4EA0-9FEA-805F4CF8F347",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "982F55FA-230E-486D-857D-A47C5580A98A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3868F007-E794-47BA-A6C2-4D5572F607D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5569A138-B8A1-4782-9E21-8189C614A8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D53B70AD-3197-4BF3-A650-FE7932380FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "99CED877-4F45-4485-9890-00B65593223E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "67A47C56-D2BA-460A-B3AD-91BD830E31C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F1651341-2B35-48B5-8B51-9935260EFFEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6E60BF36-AD7B-4198-AF3E-72B62572D194",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "FFB2741E-31D0-4FE0-90FC-F9AFCDA60FA3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCBACDA2-4A24-4E94-A97D-CE35BD2260DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D9F4CB60-AC83-4B8C-9378-DD3A0B073A83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "820DCFC1-B82D-4F9F-A9C2-00693BB4A0CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C1C780E6-F84E-4AF9-977E-A2355773C0AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D2D1D2EF-BDA5-45F8-AA65-829E388D60BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9F9C31E9-5A60-4CEE-BF09-DF1980BFFDCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "983F41DE-2696-480C-89BE-C8F9DC8F9DA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DA9BB6FB-98FE-4065-AE4F-49DE1FA82EDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "6C82B8CF-F5A9-47CA-B142-BF5615744F20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "38032178-B351-488D-8AFE-44B367331613",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "31F5A3E2-12F3-42AF-80B3-41AF54D4D668",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6D2C93-E66F-4A62-94C2-8A44C83FA3DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "CEABCB83-257F-4791-95C1-07B28C07E07B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "6331C335-1E73-4A58-B4D8-DD32E707DA82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tryton:tryton:3.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E82011DD-1E22-4969-BCFA-95FD9C995CCE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors."
},
{
"lang": "es",
"value": "Tryton 3.x en versiones anteriores a 3.2.17, 3.4.x en versiones anteriores a 3.4.14, 3.6.x en versiones anteriores a 3.6.12, 3.8.x en versiones anteriores a 3.8.8 y 4.x en versiones anteriores a 4.0.4 permiten a usuarios remotos autenticados descubrir hashes de contrase\u00f1as de usuario a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2016-1241",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.6,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-09-07T19:28:00.127",
"references": [
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3656"
},
{
"source": "security@debian.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking"
],
"url": "https://bugs.tryton.org/issue5795"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3656"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking"
],
"url": "https://bugs.tryton.org/issue5795"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-4510
Vulnerability from fkie_nvd - Published: 2013-11-18 02:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tryton:tryton:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9C3BE0CB-5798-440A-99EA-84CFC4C26051",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en el cliente de Tryton 3.0.0, tal y como se ha distribuido en la versi\u00f3n 20131104 y anteriores, permite en servidores remotos escribir archivos arbitrarios a trav\u00e9s de separadores de ruta en la extensi\u00f3n de un reporte."
}
],
"id": "CVE-2013-4510",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-11-18T02:55:08.000",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "http://hg.tryton.org/tryton/rev/357d0a4d9cb8"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2013/dsa-2791"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/11/04/21"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tryton.org/posts/security-release-for-issue3446.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "https://bugs.tryton.org/issue3446"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://hg.tryton.org/tryton/rev/357d0a4d9cb8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2013/dsa-2791"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/11/04/21"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tryton.org/posts/security-release-for-issue3446.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://bugs.tryton.org/issue3446"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2018-19443 (GCVE-0-2018-19443)
Vulnerability from cvelistv5 – Published: 2018-11-22 19:00 – Updated: 2024-08-05 11:37
VLAI?
Summary
The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:37:11.446Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://discuss.tryton.org/t/security-release-for-issue7792/830"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.tryton.org/issue7792"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-11-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-11-22T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://discuss.tryton.org/t/security-release-for-issue7792/830"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.tryton.org/issue7792"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-19443",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://discuss.tryton.org/t/security-release-for-issue7792/830",
"refsource": "MISC",
"url": "https://discuss.tryton.org/t/security-release-for-issue7792/830"
},
{
"name": "https://bugs.tryton.org/issue7792",
"refsource": "MISC",
"url": "https://bugs.tryton.org/issue7792"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-19443",
"datePublished": "2018-11-22T19:00:00",
"dateReserved": "2018-11-22T00:00:00",
"dateUpdated": "2024-08-05T11:37:11.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-6633 (GCVE-0-2014-6633)
Vulnerability from cvelistv5 – Published: 2018-04-12 15:00 – Updated: 2024-08-06 12:24
VLAI?
Summary
The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T12:24:35.619Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tryton.org/posts/security-release-for-issue4155.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.tryton.org/issue4155"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-09-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-12T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tryton.org/posts/security-release-for-issue4155.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.tryton.org/issue4155"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-6633",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tryton.org/posts/security-release-for-issue4155.html",
"refsource": "CONFIRM",
"url": "http://www.tryton.org/posts/security-release-for-issue4155.html"
},
{
"name": "https://bugs.tryton.org/issue4155",
"refsource": "CONFIRM",
"url": "https://bugs.tryton.org/issue4155"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-6633",
"datePublished": "2018-04-12T15:00:00",
"dateReserved": "2014-09-19T00:00:00",
"dateUpdated": "2024-08-06T12:24:35.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-0360 (GCVE-0-2017-0360)
Vulnerability from cvelistv5 – Published: 2017-04-04 17:00 – Updated: 2024-08-05 13:03
VLAI?
Summary
file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.
Severity ?
No CVSS data available.
CWE
- information disclosure
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | tryton-server before 3.4.0-3+deb8u3 |
Affected:
tryton-server before 3.4.0-3+deb8u3
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T13:03:57.006Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-3826",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2017/dsa-3826"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.tryton.org/trytond?cmd=changeset%3Bnode=472510fdc6f8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html"
},
{
"name": "97489",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/97489"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "tryton-server before 3.4.0-3+deb8u3",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "tryton-server before 3.4.0-3+deb8u3"
}
]
}
],
"datePublic": "2017-04-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a \"same root name but with a suffix\" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "information disclosure",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"name": "DSA-3826",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2017/dsa-3826"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.tryton.org/trytond?cmd=changeset%3Bnode=472510fdc6f8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html"
},
{
"name": "97489",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/97489"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2017-0360",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "tryton-server before 3.4.0-3+deb8u3",
"version": {
"version_data": [
{
"version_value": "tryton-server before 3.4.0-3+deb8u3"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a \"same root name but with a suffix\" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "information disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-3826",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3826"
},
{
"name": "http://hg.tryton.org/trytond?cmd=changeset;node=472510fdc6f8",
"refsource": "CONFIRM",
"url": "http://hg.tryton.org/trytond?cmd=changeset;node=472510fdc6f8"
},
{
"name": "https://lists.debian.org/debian-security-announce/2017/msg00084.html",
"refsource": "CONFIRM",
"url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html"
},
{
"name": "97489",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/97489"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2017-0360",
"datePublished": "2017-04-04T17:00:00",
"dateReserved": "2016-11-29T00:00:00",
"dateUpdated": "2024-08-05T13:03:57.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-1241 (GCVE-0-2016-1241)
Vulnerability from cvelistv5 – Published: 2016-09-07 19:00 – Updated: 2024-08-05 22:48
VLAI?
Summary
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T22:48:13.788Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.tryton.org/issue5795"
},
{
"name": "DSA-3656",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3656"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-09-07T18:57:02",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.tryton.org/issue5795"
},
{
"name": "DSA-3656",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3656"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2016-1241",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html",
"refsource": "CONFIRM",
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"name": "https://bugs.tryton.org/issue5795",
"refsource": "CONFIRM",
"url": "https://bugs.tryton.org/issue5795"
},
{
"name": "DSA-3656",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3656"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2016-1241",
"datePublished": "2016-09-07T19:00:00",
"dateReserved": "2015-12-27T00:00:00",
"dateUpdated": "2024-08-05T22:48:13.788Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-1242 (GCVE-0-2016-1242)
Vulnerability from cvelistv5 – Published: 2016-09-07 19:00 – Updated: 2024-08-05 22:48
VLAI?
Summary
file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T22:48:13.633Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"name": "DSA-3656",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3656"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.tryton.org/issue5808"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-10T15:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"name": "DSA-3656",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3656"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.tryton.org/issue5808"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2016-1242",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html",
"refsource": "CONFIRM",
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"name": "DSA-3656",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3656"
},
{
"name": "https://bugs.tryton.org/issue5808",
"refsource": "CONFIRM",
"url": "https://bugs.tryton.org/issue5808"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2016-1242",
"datePublished": "2016-09-07T19:00:00",
"dateReserved": "2015-12-27T00:00:00",
"dateUpdated": "2024-08-05T22:48:13.633Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4510 (GCVE-0-2013-4510)
Vulnerability from cvelistv5 – Published: 2013-11-15 18:16 – Updated: 2024-08-06 16:45
VLAI?
Summary
Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:45:14.817Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.tryton.org/tryton/rev/357d0a4d9cb8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tryton.org/posts/security-release-for-issue3446.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.tryton.org/issue3446"
},
{
"name": "[oss-security] 20131104 Re: possible CVE request: Tryton client input sanitization flaw",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/11/04/21"
},
{
"name": "DSA-2791",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2791"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-11-15T18:16:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.tryton.org/tryton/rev/357d0a4d9cb8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tryton.org/posts/security-release-for-issue3446.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.tryton.org/issue3446"
},
{
"name": "[oss-security] 20131104 Re: possible CVE request: Tryton client input sanitization flaw",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/11/04/21"
},
{
"name": "DSA-2791",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2791"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4510",
"datePublished": "2013-11-15T18:16:00Z",
"dateReserved": "2013-06-12T00:00:00Z",
"dateUpdated": "2024-08-06T16:45:14.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-19443 (GCVE-0-2018-19443)
Vulnerability from nvd – Published: 2018-11-22 19:00 – Updated: 2024-08-05 11:37
VLAI?
Summary
The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:37:11.446Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://discuss.tryton.org/t/security-release-for-issue7792/830"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.tryton.org/issue7792"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-11-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-11-22T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://discuss.tryton.org/t/security-release-for-issue7792/830"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.tryton.org/issue7792"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-19443",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://discuss.tryton.org/t/security-release-for-issue7792/830",
"refsource": "MISC",
"url": "https://discuss.tryton.org/t/security-release-for-issue7792/830"
},
{
"name": "https://bugs.tryton.org/issue7792",
"refsource": "MISC",
"url": "https://bugs.tryton.org/issue7792"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-19443",
"datePublished": "2018-11-22T19:00:00",
"dateReserved": "2018-11-22T00:00:00",
"dateUpdated": "2024-08-05T11:37:11.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-6633 (GCVE-0-2014-6633)
Vulnerability from nvd – Published: 2018-04-12 15:00 – Updated: 2024-08-06 12:24
VLAI?
Summary
The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T12:24:35.619Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tryton.org/posts/security-release-for-issue4155.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.tryton.org/issue4155"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-09-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-12T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tryton.org/posts/security-release-for-issue4155.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.tryton.org/issue4155"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-6633",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tryton.org/posts/security-release-for-issue4155.html",
"refsource": "CONFIRM",
"url": "http://www.tryton.org/posts/security-release-for-issue4155.html"
},
{
"name": "https://bugs.tryton.org/issue4155",
"refsource": "CONFIRM",
"url": "https://bugs.tryton.org/issue4155"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-6633",
"datePublished": "2018-04-12T15:00:00",
"dateReserved": "2014-09-19T00:00:00",
"dateUpdated": "2024-08-06T12:24:35.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-0360 (GCVE-0-2017-0360)
Vulnerability from nvd – Published: 2017-04-04 17:00 – Updated: 2024-08-05 13:03
VLAI?
Summary
file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.
Severity ?
No CVSS data available.
CWE
- information disclosure
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | tryton-server before 3.4.0-3+deb8u3 |
Affected:
tryton-server before 3.4.0-3+deb8u3
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T13:03:57.006Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-3826",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2017/dsa-3826"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.tryton.org/trytond?cmd=changeset%3Bnode=472510fdc6f8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html"
},
{
"name": "97489",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/97489"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "tryton-server before 3.4.0-3+deb8u3",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "tryton-server before 3.4.0-3+deb8u3"
}
]
}
],
"datePublic": "2017-04-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a \"same root name but with a suffix\" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "information disclosure",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"name": "DSA-3826",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2017/dsa-3826"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.tryton.org/trytond?cmd=changeset%3Bnode=472510fdc6f8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html"
},
{
"name": "97489",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/97489"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2017-0360",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "tryton-server before 3.4.0-3+deb8u3",
"version": {
"version_data": [
{
"version_value": "tryton-server before 3.4.0-3+deb8u3"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a \"same root name but with a suffix\" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "information disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-3826",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3826"
},
{
"name": "http://hg.tryton.org/trytond?cmd=changeset;node=472510fdc6f8",
"refsource": "CONFIRM",
"url": "http://hg.tryton.org/trytond?cmd=changeset;node=472510fdc6f8"
},
{
"name": "https://lists.debian.org/debian-security-announce/2017/msg00084.html",
"refsource": "CONFIRM",
"url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html"
},
{
"name": "97489",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/97489"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2017-0360",
"datePublished": "2017-04-04T17:00:00",
"dateReserved": "2016-11-29T00:00:00",
"dateUpdated": "2024-08-05T13:03:57.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-1241 (GCVE-0-2016-1241)
Vulnerability from nvd – Published: 2016-09-07 19:00 – Updated: 2024-08-05 22:48
VLAI?
Summary
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T22:48:13.788Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.tryton.org/issue5795"
},
{
"name": "DSA-3656",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3656"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-09-07T18:57:02",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.tryton.org/issue5795"
},
{
"name": "DSA-3656",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3656"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2016-1241",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html",
"refsource": "CONFIRM",
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"name": "https://bugs.tryton.org/issue5795",
"refsource": "CONFIRM",
"url": "https://bugs.tryton.org/issue5795"
},
{
"name": "DSA-3656",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3656"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2016-1241",
"datePublished": "2016-09-07T19:00:00",
"dateReserved": "2015-12-27T00:00:00",
"dateUpdated": "2024-08-05T22:48:13.788Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-1242 (GCVE-0-2016-1242)
Vulnerability from nvd – Published: 2016-09-07 19:00 – Updated: 2024-08-05 22:48
VLAI?
Summary
file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T22:48:13.633Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"name": "DSA-3656",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3656"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.tryton.org/issue5808"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-10T15:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"name": "DSA-3656",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3656"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.tryton.org/issue5808"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2016-1242",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html",
"refsource": "CONFIRM",
"url": "http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html"
},
{
"name": "DSA-3656",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3656"
},
{
"name": "https://bugs.tryton.org/issue5808",
"refsource": "CONFIRM",
"url": "https://bugs.tryton.org/issue5808"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2016-1242",
"datePublished": "2016-09-07T19:00:00",
"dateReserved": "2015-12-27T00:00:00",
"dateUpdated": "2024-08-05T22:48:13.633Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4510 (GCVE-0-2013-4510)
Vulnerability from nvd – Published: 2013-11-15 18:16 – Updated: 2024-08-06 16:45
VLAI?
Summary
Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:45:14.817Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.tryton.org/tryton/rev/357d0a4d9cb8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tryton.org/posts/security-release-for-issue3446.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.tryton.org/issue3446"
},
{
"name": "[oss-security] 20131104 Re: possible CVE request: Tryton client input sanitization flaw",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/11/04/21"
},
{
"name": "DSA-2791",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2791"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-11-15T18:16:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.tryton.org/tryton/rev/357d0a4d9cb8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tryton.org/posts/security-release-for-issue3446.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.tryton.org/issue3446"
},
{
"name": "[oss-security] 20131104 Re: possible CVE request: Tryton client input sanitization flaw",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/11/04/21"
},
{
"name": "DSA-2791",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2791"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4510",
"datePublished": "2013-11-15T18:16:00Z",
"dateReserved": "2013-06-12T00:00:00Z",
"dateUpdated": "2024-08-06T16:45:14.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}