Advisories · Technology
fogproject.
Every CVE that names fogproject among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
- fogproject
- Command injection
- Broken access control
- CVSS 7.5 High
FOG adInfo endpoint is reported to disclose the Active Directory join password
- fogproject
- Information disclosure
- CVSS 4.6 Medium
FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab
- fogproject
- Cross-site scripting (XSS)
- CVSS 8.2 High
FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules
- fogproject
- Broken access control
- CVSS 7.3 High
FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint
- fogproject
- Cross-site scripting (XSS)
- CVSS 7.3 High
FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page
- fogproject
- Cross-site scripting (XSS)
- CVSS 5.7 Medium
FOG has Stored XSS in Multiple Management Pages
- fogproject
- Cross-site scripting (XSS)
- CVSS 7.5 High
FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php`
- fogproject
- Server-side request forgery (SSRF)
- CVSS 9.9 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
FOG's authentication bypass leads to full SQL DB dump
- fogproject
- Authentication bypass
- CVSS 5.3 Medium
FOG has a Log Information Disclosure
- fogproject
- Information disclosure
- CVSS 9.3 CriticalCritical · CVSS 9+
FOG leaks sensitive information (AD domain, username and password)
- fogproject
- Command injection
- CVSS 5.3 Medium
FOG Weak file permissions
- fogproject
- Broken access control
- CVSS 7.5 High
FOG Sensitive Information Disclosure
- fogproject
- Information disclosure
- CVSS 8.8 High
FOG Authenticated File Upload RCE
- fogproject
- Unrestricted file upload
- CVSS 6.4 Medium
NFS server misconfiguration allows file access outside the exported directory
- fogproject
- CWE-453
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
FOG has a command injection in /fog/management/export.php?filename=
- fogproject
- Command injection
- CVSS 5.8 Medium
FOG path traversal via unauthenticated endpoint
- fogproject
- Path traversal
- CVSS 8.6 High
FOG SSRF via unauthenticated endpoint(s)
- fogproject
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
FOG stored XSS on log screen via unsanitized request logging
- fogproject
- Cross-site scripting (XSS)