CVE-2021-25991

In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme...

CVE-2021-25989

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them...

Cross site scripting

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them...

Cross site scripting

In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe...

Cross site scripting

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability notifications section which can be directly triggered by sending an ally request to the admin...

Improper access control

In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme...

CVE-2021-25991

CVE-2021-25991 (Ifme) : Affected software: Ifme, versions v5.0.0–v7.32. Root cause: improper access control. Impact: admins can ban themselves, resulting in deactivation from their Ifme account and complete loss of admin access. Exploit details: not provided in the supplied documents. Remediation...

CVE-2021-25991 ifme - Improper Access Control leads to admin deactivation

In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme...

CVE-2021-25991 ifme - Improper Access Control leads to admin deactivation

In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme...

CVE-2021-25990 ifme - Stored Cross-Site Scripting (XSS) in Contacts section

In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe...

CVE-2021-25990

CVE-2021-25990 affects the open-source project ifme (versions v7.22.0–v7.31.4 ). The issue is a self-stored XSS in the contacts field , arising from a lack of checksum filtering of user-supplied data and its output, allowing loading of XSS payloads via an iframe. Documented impact is client-side ...

CVE-2021-25990 ifme - Stored Cross-Site Scripting (XSS) in Contacts section

In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe...

CVE-2021-25989

Summary: CVE-2021-25989 affects the Ifme application. Vulnerability: stored XSS in the Markdown editor affecting versions 1.0.0 through 7.31.4. The payload can be triggered when a user is made a Leader of a group, according to the linked entries. Root cause (as described): lack of input/data vali...

CVE-2021-25989 ifme - Stored Cross-Site Scripting (XSS) in Groups section

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them...

CVE-2021-25989 ifme - Stored Cross-Site Scripting (XSS) in Groups section

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them...

CVE-2021-25988 ifme - Stored Cross-Site Scripting (XSS) in Notifications section

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability notifications section which can be directly triggered by sending an ally request to the admin...

CVE-2021-25988

The CVE-2021-25988 issue affects the open-source project ifme, with vulnerable versions 1.0.0 through v7.31.4. Reported as a stored XSS vulnerability in the notifications section that can be triggered by sending an ally request to an administrator. The root cause is described as lack of checksum ...

CVE-2021-25988 ifme - Stored Cross-Site Scripting (XSS) in Notifications section

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability notifications section which can be directly triggered by sending an ally request to the admin...

Ifme 跨站脚本漏洞

Ifme is open source a mental health experience community that encourages people to share their personal stories with trusted allies. Ifme suffers from a cross-site scripting vulnerability in versions v7.22.0 through v7.31.4, which stems from a lack of checksum filtering of user-supplied data and...

Ifme 跨站脚本漏洞

Ifme is open source a mental health experience community that encourages people to share their personal stories with trusted allies. A cross-site scripting vulnerability exists in ifme that stems from the product's markdown editor not doing valid validation of input data. An attacker could trigge...