How many CVEs have patched default?

7 published CVEs changed default in ikus060/rdiffweb, in 9 distinct patches totalling 60 changed lines, between 2022 and 2022.

What is the latest CVE that changed default?

CVE-2022-3362 (rdiffweb vulnerable to Insufficient Session Expiration), published 2022-11-14, changed lines 84 to 85 of rdiffweb/controller/api.py.

How does default compare to the rest of ikus060/rdiffweb?

ikus060/rdiffweb has 40 CVEs with a located fix in total; 7 of them changed default.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

default in ikus060/rdiffweb: Patched by 7 CVEs

rdiffweb vulnerable to Insufficient Session Expiration

CVE-2022-3362 · rdiffweb/controller/api.py · lines 84–85 · +2 −1

High · CVSS 8.9

EPSS 0.9%2022-11-14

rdiffweb vulnerable to Insufficient Session Expiration

CVE-2022-3362 · rdiffweb/controller/page_admin_session.py · line 49 · +1 −0

High · CVSS 8.9

EPSS 0.9%2022-11-14

rdiffweb vulnerable to Insufficient Session Expiration

CVE-2022-3362 · rdiffweb/controller/page_delete.py · line 80 · +1 −1

High · CVSS 8.9

EPSS 0.9%2022-11-14

rdiffweb vulnerable to Insufficient Session Expiration

CVE-2022-3362 · rdiffweb/controller/page_pref_session.py · line 50 · +1 −0

High · CVSS 8.9

EPSS 0.9%2022-11-14

Missing rate limit on rdiffweb

CVE-2022-3439 · rdiffweb/controller/api.py · lines 107–109 · +2 −2

Critical · CVSS 9.8

EPSS 0.8%2022-10-14

Missing rate limit on rdiffweb

CVE-2022-3456 · rdiffweb/controller/api.py · lines 107–109 · +2 −2

Critical · CVSS 9.8

EPSS 0.4%2022-10-13

Weak Password Requirements in ikus060/rdiffweb

CVE-2022-3376 · rdiffweb/controller/page_pref_general.py · lines 163–170 · +4 −1

Medium · CVSS 5.3

EPSS 0.8%2022-10-06

rdiffweb vulnerable to account access via session fixation

CVE-2022-3269 · rdiffweb/controller/page_login.py · line 93 · +1 −0

Critical · CVSS 9.3

EPSS 0.9%2022-09-23

rdiffweb Cross-Site Request Forgery vulnerability

CVE-2022-3267 · rdiffweb/controller/page_settings.py · lines 39–45 · +7 −6

Medium · CVSS 5.3

EPSS 0.4%2022-09-22

rdiffweb CSRF vulnerability in admin area can lead to deletion of repositories and users

CVE-2022-3232 · rdiffweb/controller/page_delete.py · lines 69–82 · +14 −12

Medium · CVSS 5.3

EPSS 0.4%2022-09-17

default

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track ikus060/rdiffweb CVEs