Daloradius

daloradius

Vendor: Daloradius • 7 CVEs

CVEs (7)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-0338 1Daloradius 1Daloradius Jun 17, 2026 Jan 17, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.
CVE-2023-0337 1Daloradius 1Daloradius Jun 17, 2026 Jan 17, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.
CVE-2023-0048 1Daloradius 1Daloradius Jun 17, 2026 Jan 4, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Code Injection in GitHub repository lirantal/daloradius prior to master-branch.
CVE-2023-0046 1Daloradius 1Daloradius Jun 17, 2026 Jan 4, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch.
CVE-2022-4630 1Daloradius 1Daloradius Jun 17, 2026 Dec 21, 2022 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master.
CVE-2022-4366 1Daloradius 1Daloradius Jun 17, 2026 Dec 8, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Missing Authorization in GitHub repository lirantal/daloradius prior to master branch.
CVE-2022-23475 1Daloradius 1Daloradius Jun 17, 2026 Dec 6, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting (XSS) and cross site request forgery (CSRF) vulnerability which leads to accou...Show more daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting (XSS) and cross site request forgery (CSRF) vulnerability which leads to account takeover in the mng-del.php file because of an unescaped variable reflected in the DOM on line 116. This issue has been addressed in commit `ec3b4a419e`. Users are advised to manually apply the commit in order to mitigate this issue. Users may also mitigate this issue with in two parts 1) The CSRF vulnerability can be mitigated by making the daloRadius session cookie to samesite=Lax or by the implimentation of a CSRF token in all forms. 2) The XSS vulnerability may be mitigated by escaping it or by introducing a Content-Security policy. Show less