awillix/research

Releases0

Stars1

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2022-25323 ↗	Feb 18, 2022Friday, 18 February 2022, 17:15	6.1 MEDIUM	4.3 MEDIUM
ZEROF Web Server 2.0 allows /admin.back XSS.
CVE-2021-31794 ↗	Apr 24, 2021Saturday, 24 April 2021, 20:15	6.1 MEDIUM	4.3 MEDIUM
Settings.aspx?view=About in Directum 5.8.2 allows XSS via the HTTP User-Agent header.
CVE-2021-30175 ↗	Apr 13, 2021Tuesday, 13 April 2021, 14:15	9.8 CRITICAL	7.5 HIGH
ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.
CVE-2021-30176 ↗	Apr 13, 2021Tuesday, 13 April 2021, 14:15	9.8 CRITICAL	7.5 HIGH
The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint.