linuxserver/calibre-web

Docker Hub

hub.docker.com

Releases5.35K

Frequency8 hours 54 minutes

Last Release7 days ago

Downloads202M

Stars950

A Calibre-Web container, brought to you by LinuxServer.io.

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2023-2106NVD↗	= *, < 0.6.20	Apr 15, 2023Saturday, 15 April 2023, 14:15	9.8 CRITICAL	—
Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.
CVE-2022-2525NVD↗	= *, < 0.6.20	Apr 15, 2023Saturday, 15 April 2023, 13:15	9.8 CRITICAL	—
Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.
CVE-2022-30765NVD↗	= 0.6.18, < 0.6.18	May 16, 2022Monday, 16 May 2022, 02:15	9.8 CRITICAL	7.5 HIGH
Calibre-Web before 0.6.18 allows user table SQL Injection.
CVE-2022-0990NVD↗	= *, < 0.6.18	Apr 4, 2022Monday, 4 April 2022, 18:15	9.1 CRITICAL	6.4 MEDIUM
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
CVE-2022-0939NVD↗	= *, < 0.6.18	Apr 4, 2022Monday, 4 April 2022, 10:15	9.9 CRITICAL	7.5 HIGH
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
CVE-2022-0405NVD↗	= *, < 0.6.16	Apr 3, 2022Sunday, 3 April 2022, 19:15	4.3 MEDIUM	4 MEDIUM
Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.
CVE-2022-0406NVD↗	= *, < 0.6.16	Apr 3, 2022Sunday, 3 April 2022, 19:15	4.3 MEDIUM	4 MEDIUM
Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.
CVE-2022-0766NVD↗	= *, < 0.6.17	Mar 7, 2022Monday, 7 March 2022, 07:15	9.8 CRITICAL	7.5 HIGH
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
CVE-2022-0767NVD↗	= *, < 0.6.17	Mar 7, 2022Monday, 7 March 2022, 07:15	9.9 CRITICAL	7.5 HIGH
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
CVE-2022-0339NVD↗	= *, < 0.6.16	Jan 30, 2022Sunday, 30 January 2022, 14:15	9.8 CRITICAL	7.5 HIGH
Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.
CVE-2022-0273NVD↗	= *, < 0.6.16	Jan 30, 2022Sunday, 30 January 2022, 14:15	6.5 MEDIUM	4 MEDIUM
Improper Access Control in Pypi calibreweb prior to 0.6.16.
CVE-2022-0352NVD↗	= *, < 0.6.16	Jan 28, 2022Friday, 28 January 2022, 22:15	6.1 MEDIUM	4.3 MEDIUM
Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.
CVE-2021-4164NVD↗	= *, < 0.6.15	Jan 17, 2022Monday, 17 January 2022, 13:15	8.8 HIGH	6.8 MEDIUM
calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-4171NVD↗	= *, < 0.6.15	Jan 17, 2022Monday, 17 January 2022, 10:15	9.8 CRITICAL	7.5 HIGH
calibre-web is vulnerable to Business Logic Errors
CVE-2021-4170NVD↗	= *, < 0.6.15	Jan 16, 2022Sunday, 16 January 2022, 21:15	5.4 MEDIUM	3.5 LOW
calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-25965NVD↗	= *, >= 0.6.0, <= 0.6.13	Nov 16, 2021Tuesday, 16 November 2021, 10:15	8.8 HIGH	6.8 MEDIUM
In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application.
CVE-2021-25964NVD↗	= *, >= 0.6.0, < 0.6.12	Oct 4, 2021Monday, 4 October 2021, 15:15	5.4 MEDIUM	3.5 LOW
In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered.