# rdiffweb (PyPI) vulnerabilities 43 known vulnerabilities (1 critical, 10 high, 28 medium, 4 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Weekly downloads: 692 - Dependents: 0 - Registry: https://pypi.org/project/rdiffweb/ ## Advisories (43) ### [CVE-2025-67796](https://cve.now/CVE-2025-67796): IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as… - Severity: High 8.1 - Published: May 4, 2026 - Affected: fixed in 2.10.6. ### [CVE-2023-5289](https://cve.now/CVE-2023-5289): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb - Severity: High 7.1 - Published: Sep 29, 2023 - Affected: fixed in 2.8.4; fixed in 2.8.4. ### [CVE-2023-4138](https://cve.now/CVE-2023-4138): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb - Severity: Medium 4.2 - Published: Aug 3, 2023 - Affected: fixed in 2.8.1. ### [CVE-2022-4724](https://cve.now/CVE-2022-4724): Improper Access Control in ikus060/rdiffweb - Severity: High 8.4 - Published: Dec 23, 2022 - Affected: fixed in 2.5.5; fixed in 2.5.5. ### [CVE-2022-4723](https://cve.now/CVE-2022-4723): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb - Severity: Medium 6.3 - Published: Dec 23, 2022 - Affected: fixed in 2.5.5; fixed in 2.5.5. ### [CVE-2022-4722](https://cve.now/CVE-2022-4722): Authentication Bypass by Primary Weakness in ikus060/rdiffweb - Severity: High 7.2 - Published: Dec 23, 2022 - Affected: fixed in 2.5.5; fixed in 2.5.5. ### [CVE-2022-4721](https://cve.now/CVE-2022-4721): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in ikus060/rdiffweb - Severity: Medium 6.6 - Published: Dec 23, 2022 - Affected: fixed in 2.5.5; fixed in 2.5.5. ### [CVE-2022-4720](https://cve.now/CVE-2022-4720): Open Redirect in ikus060/rdiffweb - Severity: Medium 6.1 - Published: Dec 23, 2022 - Affected: fixed in 2.5.5; fixed in 2.5.5. ### [CVE-2022-4719](https://cve.now/CVE-2022-4719): Business Logic Errors in ikus060/rdiffweb - Severity: Medium 5.7 - Published: Dec 23, 2022 - Affected: fixed in 2.5.5; fixed in 2.5.5. ### [CVE-2022-4646](https://cve.now/CVE-2022-4646): Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb - Severity: Medium 5.3 - Published: Dec 22, 2022 - Affected: fixed in 2.5.4; fixed in 2.5.4. ### [CVE-2022-4644](https://cve.now/CVE-2022-4644): Open Redirect in ikus060/rdiffweb - Severity: Medium 5.9 - Published: Dec 22, 2022 - Affected: fixed in 2.5.4; fixed in 2.5.4. ### [CVE-2022-4314](https://cve.now/CVE-2022-4314): Improper Privilege Management in ikus060/rdiffweb - Severity: Medium 6.0 - Published: Dec 6, 2022 - Affected: fixed in 2.5.2; fixed in 2.5.2. ### [CVE-2022-4018](https://cve.now/CVE-2022-4018): Missing Authentication for Critical Function in ikus060/rdiffweb - Severity: Medium 6.1 - Published: Nov 16, 2022 - Affected: fixed in 2.4.11a1; fixed in 2.5.0a6. ### [CVE-2022-3362](https://cve.now/CVE-2022-3362): Insufficient Session Expiration in ikus060/rdiffweb - Severity: Medium 6.1 - Published: Nov 14, 2022 - Affected: fixed in 2.5.0; fixed in 2.5.0. ### [CVE-2022-3363](https://cve.now/CVE-2022-3363): Business Logic Errors in ikus060/rdiffweb - Severity: Low 2.8 - Published: Oct 26, 2022 - Affected: fixed in 2.5.0; fixed in 2.5.0a7. ### [CVE-2022-3327](https://cve.now/CVE-2022-3327): Missing Authentication for Critical Function in ikus060/rdiffweb - Severity: Medium 4.5 - Published: Oct 19, 2022 - Affected: fixed in 2.4.10; fixed in 2.5.0. ### [CVE-2022-3439](https://cve.now/CVE-2022-3439): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb - Severity: Medium 4.5 - Published: Oct 14, 2022 - Affected: fixed in 2.5.0; fixed in 2.5.0. ### [CVE-2022-3457](https://cve.now/CVE-2022-3457): Origin Validation Error in ikus060/rdiffweb - Severity: Low 3.7 - Published: Oct 13, 2022 - Affected: fixed in 2.5.0a5; fixed in 2.5.0. ### [CVE-2022-3456](https://cve.now/CVE-2022-3456): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb - Severity: Medium 5.6 - Published: Oct 13, 2022 - Affected: fixed in 2.5.0; fixed in 2.5.0. ### [CVE-2022-3438](https://cve.now/CVE-2022-3438): Open Redirect in ikus060/rdiffweb - Severity: Medium 5.7 - Published: Oct 10, 2022 - Affected: fixed in 2.5.0; fixed in 2.5.0a4. ### [CVE-2022-3389](https://cve.now/CVE-2022-3389): Path Traversal in ikus060/rdiffweb - Severity: High 8.2 - Published: Oct 6, 2022 - Affected: fixed in 2.4.10; fixed in 2.4.10. ### [CVE-2022-3376](https://cve.now/CVE-2022-3376): Weak Password Requirements in ikus060/rdiffweb - Severity: Low 3.5 - Published: Oct 6, 2022 - Affected: fixed in 2.4.11a1; fixed in 2.5.0. ### [CVE-2022-3273](https://cve.now/CVE-2022-3273): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb - Severity: Low 3.6 - Published: Oct 6, 2022 - Affected: fixed in 2.5.0; fixed in 2.4.11a1. ### [CVE-2022-3371](https://cve.now/CVE-2022-3371): No limit in length of "Token name" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in… - Severity: High 7.5 - Published: Sep 30, 2022 - Affected: fixed in 2.5.0a3; fixed in 2.4.10. ### [CVE-2022-3364](https://cve.now/CVE-2022-3364): No limit in length of "Fullname" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffweb - Severity: Medium 5.3 - Published: Sep 29, 2022 - Affected: fixed in 2.4.10; fixed in 2.5.0a3. ### [CVE-2022-3326](https://cve.now/CVE-2022-3326): Weak Password Requirements in ikus060/rdiffweb - Severity: Medium 5.4 - Published: Sep 28, 2022 - Affected: fixed in 2.4.9; fixed in 2.4.9. ### [CVE-2022-3292](https://cve.now/CVE-2022-3292): Use of Cache Containing Sensitive Information in ikus060/rdiffweb - Severity: Medium 4.3 - Published: Sep 28, 2022 - Affected: fixed in 2.4.9; fixed in 2.4.8. ### [CVE-2022-3298](https://cve.now/CVE-2022-3298): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb - Severity: Medium 5.3 - Published: Sep 26, 2022 - Affected: fixed in 2.4.8; fixed in 2.4.8. ### [CVE-2022-3290](https://cve.now/CVE-2022-3290): Improper Handling of Length Parameter Inconsistency in ikus060/rdiffweb - Severity: Medium 5.7 - Published: Sep 26, 2022 - Affected: fixed in 2.4.8; fixed in 2.4.8. ### [CVE-2022-3272](https://cve.now/CVE-2022-3272): Improper Handling of Length Parameter Inconsistency in ikus060/rdiffweb - Severity: Medium 5.3 - Published: Sep 26, 2022 - Affected: fixed in 2.4.8; fixed in 2.4.8. ### [CVE-2022-3295](https://cve.now/CVE-2022-3295): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb - Severity: Medium 5.3 - Published: Sep 26, 2022 - Affected: fixed in 2.4.8; fixed in 2.4.8. ### [CVE-2022-3301](https://cve.now/CVE-2022-3301): Improper Cleanup on Thrown Exception in ikus060/rdiffweb - Severity: Medium 4.3 - Published: Sep 26, 2022 - Affected: fixed in 2.4.8; fixed in 2.4.8. ### [CVE-2022-3269](https://cve.now/CVE-2022-3269): Session Fixation in ikus060/rdiffweb - Severity: Medium 6.4 - Published: Sep 23, 2022 - Affected: fixed in 2.4.7; fixed in 2.4.7. ### [CVE-2022-3274](https://cve.now/CVE-2022-3274): Cross-Site Request Forgery (CSRF) on user's settings in GitHub repository ikus060/rdiffweb prior to 2.4.6. in ikus060/rdiffweb - Severity: High 7.0 - Published: Sep 22, 2022 - Affected: fixed in 2.4.7; fixed in 2.4.7. ### [CVE-2022-3267](https://cve.now/CVE-2022-3267): Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb - Severity: Medium 6.8 - Published: Sep 22, 2022 - Affected: fixed in 2.4.6; fixed in 2.4.6. ### [CVE-2022-3233](https://cve.now/CVE-2022-3233): Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb - Severity: Medium 4.3 - Published: Sep 21, 2022 - Affected: fixed in 2.4.6; fixed in 2.4.6. ### [CVE-2022-3250](https://cve.now/CVE-2022-3250): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb - Severity: Medium 4.9 - Published: Sep 21, 2022 - Affected: fixed in 2.4.6; fixed in 2.4.6. ### [CVE-2022-3232](https://cve.now/CVE-2022-3232): Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb - Severity: Medium 6.5 - Published: Sep 17, 2022 - Affected: fixed in 2.4.5; fixed in 2.4.5. ### [CVE-2022-3221](https://cve.now/CVE-2022-3221): Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb - Severity: High 8.8 - Published: Sep 15, 2022 - Affected: fixed in 2.4.3. ### [CVE-2022-3179](https://cve.now/CVE-2022-3179): Weak Password Requirements in ikus060/rdiffweb - Severity: High 7.1 - Published: Sep 13, 2022 - Affected: from 2.4.1, fixed in 2.4.2; fixed in 2.4.2. ### [CVE-2022-3174](https://cve.now/CVE-2022-3174): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb - Severity: High 7.5 - Published: Sep 13, 2022 - Affected: from 2.4.1, fixed in 2.4.2; fixed in 2.4.2. ### [CVE-2022-3175](https://cve.now/CVE-2022-3175): Missing Custom Error Page in ikus060/rdiffweb - Severity: Medium 5.3 - Published: Sep 13, 2022 - Affected: from 2.4.1, fixed in 2.4.2; fixed in 2.4.2. ### [CVE-2022-3167](https://cve.now/CVE-2022-3167): Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb - Severity: Critical 10.0 - Published: Sep 8, 2022 - Affected: fixed in 2.4.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/rdiffweb Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.