PT-2026-1317

Name of the Vulnerable Software and Affected Versions PLANKA version 2.0.0 Description The application does not implement X-Frame-Options and CSP frame-ancestors headers, which allows it to be embedded within malicious iframes. This can expose users to phishing attacks through UI Redressing,...

WS-2022-0315

planka before 1.7.4 is vulnerable to forced browsing, which can lead to phishing attacks for example, redirecting the site to a fake login page. This can also lose data because Planka allows redirects without requesting that the user confirm leaving the page...

WS-2022-0312

Session does not expire on logout in plankanban/planka before 1.8.0...

CVE-2022-2653 Path Traversal in plankanban/planka

With this vulnerability an attacker can read many sensitive files like configuration files, or the /proc/self/environ file, that contains the environment variable used by the web server that includes database credentials. If the web server user is root, an attacker will be able to read any file i...

Planka 路径遍历漏洞

Planka is Planka open source a Trello-like Kanban built using React and Redux. Planka v1.5.2 before the version of the path traversal vulnerability , the vulnerability stems from if the user of the web server is root , an attacker will be able to read any file in the system . Using this...

WS-2022-0248

The administrative /api/users registration endpoint in plankanban/planka is vulnerable to a Cross-Site Request Forgery CSRF attack due to the lack of any kind of anti-CSRF token verification. An attacker can gain access to the platform via the newly created account without the administrator...

WS-2022-0291

In planka, an attacker can upload an attachment without any size limitation which leads to an exception and the crash of the application...

WS-2022-0289

In planka, The login page doesn't have any protection against a brute-force password attack, which allows an attacker to try every possible password combination without any restriction...