partkeepr/PartKeepr

partkeepr/PartKeepr

on GitHub

32 releases

new releases every 2 months 1 week

last release was 04/28/2018

last checked yesterday at 9:44 PM

1315

Open Source Inventory Management

Log in to subscribe

CVE History

CVE	Published	CVSS v2	CVSS v3
CVE-2022-30899	June 8, 2022	4.8 MEDIUM	3.5 LOW
A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories.
CVE-2021-39390	May 3, 2022	5.4 MEDIUM	3.5 LOW
Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter.
CVE-2022-22701	January 10, 2022	6.5 MEDIUM	4 MEDIUM
PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated user to read local files.
CVE-2022-22702	January 10, 2022	4.3 MEDIUM	4 MEDIUM
PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to local ports, allowing an authenticated user to carry out SSRF attacks and port enumeration.