CVE-2017-15203

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user...

CVE-2017-15204

In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user...

CVE-2017-15205

In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user...

Design/Logic Flaw

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user...

Code injection

In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user...

Design/Logic Flaw

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user...

Code injection

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user...

Design/Logic Flaw

In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user...

Design/Logic Flaw

In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another user...

Code injection

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user...

Design/Logic Flaw

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user...

Design/Logic Flaw

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user...

Design/Logic Flaw

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user...

Design/Logic Flaw

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description...

Code injection

In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user...

CVE-2017-15204: Authorization Bypass Through User-Controlled Key

In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user...

CVE-2017-15202: Authorization Bypass Through User-Controlled Key

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user...

CVE-2017-15205: Exposure of Sensitive Information to an Unauthorized Actor

In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user...

CVE-2017-15208: Authorization Bypass Through User-Controlled Key

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user...

CVE-2017-15195: Authorization Bypass Through User-Controlled Key

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user...