Skip to content
Noroxi

pydio records

36 published records for vendor pydio.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
4
With a fix record
5.6%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 23
  7. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

36 records
  • CVE-2013-4267
    40Plan

    Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to

    CriticalCVSS 9.8No exploitEPSS 4%

    pydio · pydioFeb 11, 2020

  • CVE-2015-3431
    40Plan

    Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Comman

    CriticalCVSS 9.8No exploitEPSS 4%

    pydio · pydioSep 19, 2017

  • CVE-2018-20718
    40Plan

    In Pydio before 8.2.2, an attack is possible via PHP Object Injection because a user is allowed to use the $phpserial$a:0:{} syntax to store

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    pydio · pydioJan 15, 2019

  • CVE-2019-9642
    40Plan

    An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2.

    CriticalCVSS 9.8No exploitEPSS 2%

    pydio · pydioJun 5, 2019

  • CVE-2023-32749
    39Monitor

    Pydio Cells allows users by default to create so-called external users in order to share files with them.

    HighCVSS 8.8Proof of conceptEPSS 14%

    pydio · cellsJun 8, 2023

  • CVE-2019-20452
    36Monitor

    A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4.

    HighCVSS 8.8No exploitEPSS 2%

    pydio · pydioMar 17, 2020

  • CVE-2019-20453
    36Monitor

    A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4.

    HighCVSS 8.8No exploitEPSS 2%

    pydio · pydioMar 17, 2020

  • CVE-2019-12901
    35Monitor

    Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete file

    HighCVSS 8.8No exploitEPSS 1%

    pydio · cellsJun 19, 2019

  • CVE-2013-6227
    32Monitor

    Unrestricted file upload vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly AjaXplorer) before 5

    HighCVSS 7.5Proof of conceptEPSS 7%

    ajaxplorer · ajaxplorerDec 27, 2014

  • CVE-2020-12851
    32Monitor

    Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells folders (repositori

    HighCVSS 8.1No exploitEPSS 1%

    pydio · cellsJun 4, 2020

  • CVE-2018-14772
    30Monitor

    Pydio 4.2.1 through 8.2.1 has an authenticated remote code execution vulnerability in which an attacker with administrator access to the web

    HighCVSS 7.2Proof of conceptEPSS 6%

    pydio · pydioOct 16, 2018

  • CVE-2019-15033
    30Monitor

    Pydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download.

    HighCVSS 7.7No exploitEPSS 1%

    pydio · pydioSep 19, 2019

  • CVE-2019-10048
    29Monitor

    The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of u

    HighCVSS 7.2No exploitEPSS 3%

    pydio · pydioMay 31, 2019

  • CVE-2020-12847
    29Monitor

    Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator ro

    HighCVSS 7.2No exploitEPSS 1%

    pydio · cellsJun 4, 2020

  • CVE-2019-10049
    29Monitor

    It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into op

    HighCVSS 7.3No exploitEPSS 1%

    pydio · pydioMay 31, 2019

  • CVE-2020-12852
    28Monitor

    The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the

    MediumCVSS 6.8No exploitEPSS 2%

    pydio · cellsJun 4, 2020

  • CVE-2020-12850
    28Monitor

    The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4.

    HighCVSS 7.0No exploitEPSS 0%

    pydio · cellsJun 10, 2020

  • CVE-2023-32750
    27Monitor

    Pydio Cells through 4.1.2 allows SSRF.

    MediumCVSS 6.5Proof of conceptEPSS 3%

    pydio · cellsJun 8, 2023

  • CVE-2018-1999018
    27Monitor

    Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.anti

    MediumCVSS 6.6No exploitEPSS 3%

    pydio · pydioJul 23, 2018

  • CVE-2021-41324
    27Monitor

    Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal file

    MediumCVSS 6.5No exploitEPSS 2%

    pydio · cellsSep 30, 2021

  • CVE-2021-41323
    27Monitor

    Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells fil

    MediumCVSS 6.5No exploitEPSS 2%

    pydio · cellsSep 30, 2021

  • CVE-2021-41325
    26Monitor

    Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile paramete

    MediumCVSS 6.5No exploitEPSS 1%

    pydio · cellsSep 30, 2021

  • CVE-2019-12902
    26Monitor

    Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion.

    MediumCVSS 6.5No exploitEPSS 1%

    pydio · cellsJun 19, 2019

  • CVE-2019-10045
    26Monitor

    The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scr

    MediumCVSS 6.5No exploitEPSS 1%

    pydio · pydioMay 31, 2019

  • CVE-2018-1999016
    24Monitor

    Pydio version 8.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in ./core/vendor/meenie/javascript-packer/example-inline

    MediumCVSS 6.1No exploitEPSS 0%

    pydio · pydioJul 23, 2018