5380 matches found
CVE-2026-5266
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from before 1.43.7, 1.44.4, 1.45.2...
CVE-2026-5266
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from before 1.43.7, 1.44.4, 1.45.2...
CVE-2026-5266
CVE-2026-5266 affects Wikimedia Foundation Echo, specifically the includes/Api/ApiEchoNotifications.Php component. The vulnerability allows exposure of sensitive information to an unauthorized actor and affects Echo versions before 1.43.7, 1.44.4, and 1.45.2. The Debian advisory notes the issue c...
Wikimedia Echo 信息泄露漏洞
Wikimedia Echo is a messaging extension provided by the Wikimedia Foundation that offers features for sending notifications within the site and reminding users. Wikimedia Echo has a vulnerability related to information leakage, which stems from the exposure of sensitive information in the program...
ECHO-0DDA-835F-39BB
Bulletin has no description...
ECHO-6775-52BC-CD81
Bulletin has no description...
ECHO-4023-B34A-25B0
Bulletin has no description...
ECHO-1EEA-BB40-C2E4
Bulletin has no description...
ECHO-D67B-10D3-32FC
Bulletin has no description...
ECHO-37BD-48CD-23B4
Bulletin has no description...
ECHO-33EA-8335-42C0
Bulletin has no description...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through the PUT /api/echo/like/:id endpoint, which lacks authentication and rate limiting. An attacker can manipulate the favcount of any echo, including private ones, by sending repeated requests without...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through the PUT /api/echo/like/:id endpoint, which lacks authentication and rate limiting. An attacker can manipulate the favcount of any echo, including private ones, by sending repeated requests without...
GHSA-PJ6Q-4VQ4-R8CG Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count
Summary PUT /api/echo/like/:id at internal/router/echo.go:12 is registered on PublicRouterGroup with no authentication and no rate limit. Anonymous callers increment the favcount counter on any echo including private echoes by UUID, repeat the request without deduplication, and trigger a database...
ECHO-C13C-F4B9-2ECE
Bulletin has no description...
ECHO-71BE-89BB-7761
Bulletin has no description...
ECHO-A2CB-9FEB-100C
Bulletin has no description...
ECHO-04E0-8CCC-E285 Fix algorithm confusion with public keys used as HMAC secret. Backported from https://github.com/mpdavis/python-jose/commit/12f30c8
Bulletin has no description...