Advisories · Technology
dylanjkotze Zephyr Project Manager.
Every CVE that names dylanjkotze Zephyr Project Manager among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter
- dylanjkotze Zephyr Project Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter
- dylanjkotze Zephyr Project Manager
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
Zephyr Project Manager <= 3.3.203 - Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery
- dylanjkotze Zephyr Project Manager
- Path traversal
- CVSS 4.4 Medium
Zephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scripting
- dylanjkotze Zephyr Project Manager
- Cross-site scripting (XSS)
- CVSS 8.1 High
Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation
- dylanjkotze Zephyr Project Manager
- Broken access control
- CVSS 6.4 Medium
Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter
- dylanjkotze Zephyr Project Manager
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting
- dylanjkotze Zephyr Project Manager
- Cross-site scripting (XSS)