Advisories · Technology
sysadminsmedia homebox.
Every CVE that names sysadminsmedia homebox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service
- sysadminsmedia homebox
- CWE-178
- CWE-1024
- CVSS 5.4 Medium
HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields
- sysadminsmedia homebox
- Cross-site scripting (XSS)
- CVSS 3.7 Low
HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay
- sysadminsmedia homebox
- CWE-204
- CWE-208
- CVSS 6.4 Medium
Homebox generic notifier SSRF via HTTP redirect after URL validation
- sysadminsmedia homebox
- Server-side request forgery (SSRF)
- CVSS 6.0 Medium
HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress
- sysadminsmedia homebox
- Server-side request forgery (SSRF)
- CVSS 8.1 High
HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching
- sysadminsmedia homebox
- Privilege escalation
- Broken access control
- CVSS 5.4 Medium
HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler
- sysadminsmedia homebox
- Broken access control
- CWE-841
- CVSS 8.1 High
HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox
- sysadminsmedia homebox
- Broken access control
- CVSS 8.1 High
HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack
- sysadminsmedia homebox
- Hard-coded credentials
- Broken access control
- CVSS 8.1 High
HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation
- sysadminsmedia homebox
- CWE-708
- CVSS 7.4 High
HomeBox has an Auth Rate Limit Bypass via IP Spoofing
- sysadminsmedia homebox
- Authentication bypass
- CVSS 5.0 Medium
HomeBox affected by Blind SSRF
- sysadminsmedia homebox
- Server-side request forgery (SSRF)
- CVSS 4.6 Medium
HomeBox affected by Stored XSS via HTML/SVG Attachment Upload
- sysadminsmedia homebox
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
HomeBox Missing User Authorization
- sysadminsmedia homebox
- Broken access control