Tiny Tiny Rss (Tt-rss) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2021-03-13. Vendor: Tt-rss.

CVEs of Tiny Tiny Rss

• CVE-2021-28373 - CVSS 7.5 (high), 2021-03-13: The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this…
• CVE-2020-25789 - CVSS 6.1 (medium), 2020-09-19: An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. The cached_url feature mishandles JavaScript inside an SVG document.
• CVE-2020-25787 - CVSS 9.8 (critical), 2020-09-19: An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them.
• CVE-2020-25788 - CVSS 8.1 (high), 2020-09-19: An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error…
• CVE-2017-16896 - CVSS 9.8 (critical), 2017-11-20: A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the login parameter.
• CVE-2017-1000035 - CVSS 6.1 (medium), 2017-07-17: Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack