PatchTheCVEinedo vulnerabilities
Recent CVEs affecting inedo products. 8 tracked.
inedo has 8 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 8. Most recent: 2018-09-26. Highest priority: CVE-2017-16521 (score 60/100).
- CVE-2017-17086 CRITICAL 9.8 UPGRADE Indeo Otter through 1.7.4 mishandles a "</script>" substring in an initial DP payload, which allows remote att
- CVE-2017-16761 MEDIUM 6.1 UPGRADE An Open Redirect vulnerability in Inedo BuildMaster before 5.8.2 allows remote attackers to redirect users to
- CVE-2017-16760 MEDIUM 6.1 UPGRADE Inedo BuildMaster before 5.8.2 has XSS.
- CVE-2017-16521 CRITICAL 9.8 UPGRADE In Inedo BuildMaster before 5.8.2, XslTransform was used where XslCompiledTransform should have been used.
- CVE-2017-16520 HIGH 7.5 UPGRADE Inedo BuildMaster before 5.8.2 does not properly restrict creation of RequireManageAllPrivileges event listene
- CVE-2017-15608 MEDIUM 6.5 UPGRADE Inedo ProGet before 5.0 Beta5 has CSRF, allowing an attacker to change advanced settings.
- CVE-2017-15607 CRITICAL 9.8 UPGRADE Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' character
- CVE-2017-14944 HIGH 7.5 UPGRADE Inedo ProGet before 4.7.14 does not properly address dangerous package IDs during package addition, aka PG-106
FAQ
How do I fix inedo vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is inedo being exploited right now?
None of the tracked inedo CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which inedo CVE should I patch first?
CVE-2017-16521 currently ranks highest (60/100): In Inedo BuildMaster before 5.8.2, XslTransform was used where XslCompiledTransform should have been used..