Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how universityofcalifornia compares to other vendors in security performance

View Risk Score →

BOINC BOINC ServerBOINC Server Cross-Site Request Forgery

Risk 77
Severity
8.8
CSRF
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Cross-Site Request Forgery (CSRF) vulnerability in BOINC Server allows Cross Site Request Forgery.This issue affects BOINC Server: before 1.4.3.

First published (updated )
CVE-2025-0669

BOINC BOINC ServerBOINC Server Multiple SQL Injections

Risk 86
Severity
9.8
SQL Injection, XSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BOINC Server allows Stored XSS.This issue affects BOINC Server: before 1.4.5.

First published (updated )
CVE-2025-0668

BOINC BOINC ServerBOINC Server Stored XSS Injection in pm.php

Risk 70
Severity
8.7
XSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BOINC Server allows Stored XSS.This issue affects BOINC Server: through 1.4.7.

First published (updated )
CVE-2025-0667

BOINC BOINC ServerBOINC Server Stored XSS Injection in host_venue_action.php

Risk 59
Severity
7
XSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BOINC Server allows Stored XSS.This issue affects BOINC Server: through 1.4.7.

First published (updated )
CVE-2025-0666

Berkeley BoincSQL Injection

Risk 86
Severity
9.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-2018

Berkeley Berkeley Open Infrastructure for Network ComputingBerkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 c…

Risk 86
Severity
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutable Data vulnerability in Website Terms of Service Acceptance Page that can result in Access to any user account. This attack appear to be exploitable via Specially crafted URL. This vulnerability appears to have been fixed in 1.0.3.

First published (updated )
CVE-2018-1000875

Rom Walton BoincBuffer Overflow

Risk 79
Severity
9.3
Buffer Overflow
AV:N/AC:M/Au:N/C:C/I:C/A:C

Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.

First published (updated )
CVE-2013-2298

Rom Walton BoincBuffer Overflow

Risk 79
Severity
9.3
Buffer Overflow
AV:N/AC:M/Au:N/C:C/I:C/A:C

Stack-based buffer overflow in BOINC 6.10.58 and 6.12.34 allows remote attackers to have unspecified impact via multiple filesignature elements.

First published (updated )
CVE-2013-2019

Rom Walton BoincBuffer Overflow

Risk 26
Severity
5
Buffer Overflow
AV:N/AC:L/Au:N/C:N/I:N/A:P

Multiple stack-based buffer overflows in BOINC 6.13.x allow remote attackers to cause a denial of service (crash) via a long trickle-up to (1) client/cstrickle.cpp or (2) db/dbbase.cpp.

First published (updated )
CVE-2011-5280

Rom Walton BoincFormat string vulnerability in the PROJECT::write_account_file function in client/cs_account.cpp in …

Risk 26
Severity
5
AV:N/AC:L/Au:N/C:N/I:N/A:P

Format string flaw was found in the way boinc-client, a Berkeley Open Infrastructure for Network Computing (BOINC) client for distributed computing, performed account information write / dump into corresponding XML file. An attacker could provide an account file (file containing account information) with specially-crafted value of the 'guiurls' item that, when processed would lead to boinc-client executable crash or, potentially, arbitrary code execution with the privileges of the user running the boinc-client binary.

References: [1] http://www.openwall.com/lists/oss-security/2013/04/28/3

Relevant upstream patch: [2] http://boinc.berkeley.edu/gitweb/?p=boinc-v2.git;a=commitdiff;h=99258dcecba8ef36e1ce0fd6e0dacffe53613ac9

1 / 2
Source: Red Hat
First published (updated )
CVE-2013-7386

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203