Iobroker

iobroker

3 CVEs • 3 products

Products (3)

Click to collapse

Toggle

Iobroker.js Controller

iobroker.js-controller

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-10771 1Iobroker 1Iobroker.web Jun 17, 2026 Nov 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Characters in the GET url path are not properly escaped and can be reflected in the server response.
CVE-2019-10767 1Iobroker 1Iobroker.js Controller Jun 17, 2026 Nov 21, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adap...Show more An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. Note: The attacker has to be logged in if the authentication is enabled (by default isn't enabled).Show less
CVE-2019-10765 1Iobroker 1Iobroker.admin Jun 17, 2026 Nov 20, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.