Advisories · Technology
cvat.
Every CVE that names cvat among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.5 High
CVAT: Stored XSS via annotation guides in audio tasks
- cvat
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
CVAT: Flawed authorization logic in endpoints related to lambda requests
- cvat
- Broken access control
- CVSS 5.3 Medium
CVAT: Denial of service with regards to automatic annotation
- cvat
- CWE-1288
- CVSS 8.5 High
CVAT has stored XSS via annotation guide assets
- cvat
- Cross-site scripting (XSS)
- Unrestricted file upload
- CVSS 7.1 High
CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes
- cvat
- Path traversal
- CVSS 5.3 Medium
CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence
- cvat
- Broken access control
- CVSS 8.5 High
CVAT: Stored XSS via annotation guides
- cvat
- Cross-site scripting (XSS)
- CVSS 8.5 High
CVAT vulnerable to privilege escalation of users with staff status
- cvat
- Privilege escalation
- CVSS 8.6 High
CVAT vulnerable to XSS via skeleton SVG images
- cvat
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
CVAT vulnerable to directory traversal via mounted share listing
- cvat
- Path traversal
- CVSS 5.3 Medium
CVAT: Mounted share file overwrite via crafted request
- cvat
- Path traversal
- CVSS 4.3 Medium
CVAT vulnerable to email verification bypass by use of basic authentication
- cvat
- Authentication bypass
- CVSS 5.3 Medium
CVAT missing validation for in-progress backup upload names
- cvat
- Broken access control
- CVSS 5.3 Medium
CVAT has information disclosure via browsable API
- cvat
- Information disclosure
- CVSS 8.7 High
CVAT allows remote code execution via tracker Nuclio functions
- cvat
- Insecure deserialization
- CVSS 5.4 Medium
Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints
- cvat
- Broken access control
- CVSS 6.3 Medium
Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints
- cvat
- Cross-site scripting (XSS)
- CWE-81
- CVSS 6.2 Medium
Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint
- cvat
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries
- cvat
- Broken access control
- CVSS 7.1 High
CVAT's export and backup-related API endpoints are susceptible to CSRF
- cvat
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
CVAT SSRF via custom cloud storage endpoints
- cvat
- Server-side request forgery (SSRF)
- CVSS 8.6 HighCritical · CVSS 7+ and EPSS
Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)
- cvat
- Server-side request forgery (SSRF)