CVE-2022-31136 Cross-site Scripting in BookWyrm

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as...

CVE-2022-31136

Bookwyrm (an open source social reading app) is affected by CVE-2022-31136 due to improper sanitization of HTML rendered to users in profiles, book descriptions, and statuses before version 0.4.1. The root cause is inadequate HTML sanitization which enables cross-site scripting (XSS) by unprivile...

CVE-2022-31136

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as...

CVE-2022-31136 Cross-site Scripting in BookWyrm

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as...

PT-2022-20556

Name of the Vulnerable Software and Affected Versions Bookwyrm versions prior to 0.4.1 Description The issue concerns an open source social reading and reviewing program where versions prior to 0.4.1 did not properly sanitize HTML being rendered to users. Unprivileged users can inject scripts int...

BookWyrm 跨站脚本漏洞

BookWyrm is a social reading platform. A cross-site scripting vulnerability exists in BookWyrm versions prior to 0.4.1, which stems from not properly cleaning up the html presented to the user, and is exploited by an attacker to perform cross-site scripting attacks...

CVE-2022-31136: Improper Neutralization of Input During Web Page Generation

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as...

WS-2022-0227

Email enumeration via Reset password page in bookwyrm-social/bookwyrm before 0.4.2...

WS-2022-0228

Insecure direct object references IDOR in create-shelf function in bookwyrm-social/bookwyrm before 0.4.4...

WS-2022-0223

Improper Link Input Validation leads to Cross-site Scripting XSS in bookwyrm-social/bookwyrm before 0.4.1...

WS-2022-0225

Cross-Site Request Forgery CSRF in bookwyrm-social/bookwyrm before 0.4.3...

CVE-2022-23644

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...

Server side request forgery (ssrf)

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...

CVE-2022-23644 Server-side request forgery in BookWyrm

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...

CVE-2022-23644

BookWyrm contains a server-side request forgery (SSRF) flaw in the “load cover via URL” feature. Any instance running a version before 0.3.0 is susceptible to an attack from a logged-in user. The issue has been patched in 0.3.0; administrators should upgrade. As a workaround, close registration a...

CVE-2022-23644 Server-side request forgery in BookWyrm

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...

CVE-2022-23644 Server-side request forgery in BookWyrm

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...

PT-2022-16156

Name of the Vulnerable Software and Affected Versions BookWyrm versions prior to 0.3.0 Description The functionality to load a cover via URL in BookWyrm is vulnerable to a server-side request forgery attack. This issue can be exploited by a logged-in user. As a workaround, BookWyrm instances can...

BookWyrm 代码问题漏洞

BookWyrm is a social reading platform. BookWyrm suffers from a code issue vulnerability that stems from the fact that the url load cover feature is vulnerable to server-side request forgery attacks. An attacker can exploit the vulnerability to send unintended requests to the server via an affecte...

CVE-2022-23644: Server-Side Request Forgery (SSRF)

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...