Bitrix24 - vulnerabilities (CVEs)
20 CVEs in 3 products, 0 in the last 30 days, newest from 2024-11-04.
Products
- Bitrix24 - 17 CVEs
- Bitrix Site Manager - 2 CVEs
- Bitrix Framework - 1 CVEs
Newest CVEs of Bitrix24
- CVE-2024-34891 - CVSS 6.8 (medium), 2024-11-04: Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange account passwords…
- CVE-2024-34885 - CVSS 6.8 (medium), 2024-11-04: Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via…
- CVE-2024-34887 - CVSS 6.8 (medium), 2024-11-04: Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators…
- CVE-2024-34883 - CVSS 6.8 (medium), 2024-11-04: Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts…
- CVE-2024-34882 - CVSS 6.8 (medium), 2024-11-04: Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP account passwords to…
- CVE-2023-1714 - CVSS 8.8 (high), 2023-11-01: Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute…
- CVE-2023-1717 - CVSS 9.6 (critical), 2023-11-01: Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute…
- CVE-2023-1720 - CVSS 9.6 (critical), 2023-11-01: Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and…
- CVE-2023-1716 - CVSS 9.6 (critical), 2023-11-01: Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's…
- CVE-2023-1719 - CVSS 9.8 (critical), 2023-11-01: Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the…
- CVE-2023-1715 - CVSS 9 (critical), 2023-11-01: A logic error when using mb_strpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags…
- CVE-2023-1718 - CVSS 7.5 (high), 2023-11-01: Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause…
- CVE-2023-1713 - CVSS 8.8 (high), 2023-11-01: Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote…
- CVE-2022-43959 - CVSS 4.9 (medium), 2023-01-20: Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an…
- CVE-2017-20122 - CVSS 5.4 (medium), 2022-06-30: A vulnerability classified as problematic was found in Bitrix Site Manager 12.06.2015. Affected by this vulnerability is an unknown functionality of the…
- CVE-2022-27228 - CVSS 9.8 (critical), 2022-03-22: In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code.
- CVE-2020-28206 - CVSS 6.5 (medium), 2020-12-02: An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restriction of Excessive Authentication…
- CVE-2020-13484 - CVSS 9.8 (critical), 2020-06-24: Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php?action=attachUrlPreview url parameter, if the destination URL…
- CVE-2020-13483 - CVSS 6.1 (medium), 2020-06-24: The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI.
- CVE-2008-2052 - CVSS 6.1 (medium), 2008-05-02: Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing…
