Vulnerabilities > Vanderbilt > Redcap > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-09-07 | CVE-2023-37798 | Cross-site Scripting vulnerability in Vanderbilt Redcap A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the project title parameter. | 5.4 |
| 2022-10-12 | CVE-2022-42715 | Cross-site Scripting vulnerability in Vanderbilt Redcap A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. | 6.1 |
| 2021-01-12 | CVE-2020-26713 | Cross-site Scripting vulnerability in Vanderbilt Redcap 10.0.20/10.3.4 REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. | 4.3 |
| 2020-11-02 | CVE-2020-27358 | Incorrect Default Permissions vulnerability in Vanderbilt Redcap An issue was discovered in REDCap 8.11.6 through 9.x before 10. | 4.0 |
| 2019-08-17 | CVE-2019-14937 | SQL Injection vulnerability in Vanderbilt Redcap REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. | 6.0 |
| 2018-02-08 | CVE-2017-7351 | SQL Injection vulnerability in Vanderbilt Redcap 7.0.0 A SQL injection issue exists in a file upload handler in REDCap 7.x before 7.0.11 via a trailing substring to SendITController:upload. | 4.0 |
| 2017-07-18 | CVE-2017-10962 | Cross-site Scripting vulnerability in Vanderbilt Redcap REDCap before 7.5.1 has XSS via the query string. | 4.3 |
| 2017-07-18 | CVE-2017-10961 | Cross-Site Request Forgery (CSRF) vulnerability in Vanderbilt Redcap REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload components. | 6.8 |
| 2013-06-17 | CVE-2013-4612 | Cross-Site Scripting vulnerability in multiple products Multiple cross-site scripting (XSS) vulnerabilities in REDCap before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving different modules. | 4.3 |
| 2013-06-17 | CVE-2013-4609 | Permissions, Privileges, and Access Controls vulnerability in multiple products REDCap before 5.0.4 and 5.1.x before 5.1.3 does not reject certain undocumented syntax within branching logic and calculations, which allows remote authenticated users to bypass intended access restrictions via (1) the Online Designer or (2) the Data Dictionary upload, as demonstrated by an eval call. | 6.5 |