Advisories · Technology
Bitrix24.
Every CVE that names Bitrix24 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.6 CriticalCritical · CVSS 9+
Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload
- Bitrix24
- Unrestricted file upload
- CVSS 7.5 High
Bitrix24 Insecure Global Variable Extraction
- Bitrix24
- CWE-665
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access
- Bitrix24
- Denial of service
- CVSS 9.6 CriticalCritical · CVSS 9+
Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution
- Bitrix24
- Cross-site scripting (XSS)
- Prototype pollution
- CVSS 9.0 CriticalCritical · CVSS 9+
Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)
- Bitrix24
- Cross-site scripting (XSS)
- CVSS 9.0 CriticalCritical · CVSS 9+
Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)
- Bitrix24
- Cross-site scripting (XSS)
- CVSS 8.8 High
Bitrix24 Remote Command Execution (RCE) via Unsafe Variable Extraction
- Bitrix24
- Insecure deserialization
- CVSS 8.8 High
Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation
- Bitrix24
- Unrestricted file upload