User account enumeration in Serenity

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist...

GHSA-W7JM-9X4M-8QC3 User account enumeration in Serenity

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist...

Insufficient token expiration in Serenity

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the...

GHSA-2HP9-3XFR-R9W2 Insufficient token expiration in Serenity

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the...

CVE-2023-31286

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist...

CVE-2023-31287

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the...

CVE-2023-31285

CVE-2023-31285 concerns Serenity Serene (StartSharp) prior to 6.7.0, where the file-upload validation blocks some extensions but still allows .html/.htm uploads containing an XSS payload. The resulting link can be sent to an administrator, enabling an XSS risk as described across multiple sources...

CVE-2023-31286

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist...

CVE-2023-31287

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the...

CVE-2023-31287

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the...

PT-2023-23272 · Unknown · Startsharp +1

Name of the Vulnerable Software and Affected Versions: Serenity Serene versions prior to 6.7.0 StartSharp versions prior to 6.7.0 Description: A security issue was discovered where users can upload temporary files with certain file endings, such as .html or .htm, that contain a malicious payload...

Serenity Serene 安全漏洞

Serenity Serene is serenity open source is an ASP.NET Core / TypeScript application platform. A security vulnerability exists in Serenity Serene StartSharp versions prior to 6.7.0, which stems from a server response that discloses a user's presence when a password reset request occurs...

CVE-2023-31286

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist...

CVE-2023-31287: Weak Password Recovery Mechanism for Forgotten Password

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the...

CVE-2023-31285

An XSS issue was discovered in Serenity Serene and StartSharp before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be sent to an administrator user...

CVE-2023-31286

Summary: CVE-2023-31286 affects Serenity Serene and StartSharp prior to 6.7.0. The issue arises during password reset requests, where the server response reveals whether a user exists. Specifically, attempting to reset a password for a non-existent user yields an error message indicating that the...

PT-2023-23273 · Unknown · Startsharp +1

Name of the Vulnerable Software and Affected Versions: Serenity Serene versions prior to 6.7.0 StartSharp versions prior to 6.7.0 Description: An issue was discovered where the server response to a password reset request leaks the existence of users. If a password reset is attempted for a...

CVE-2023-31286

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist...

CVE-2023-31286: Generation of Error Message Containing Sensitive Information

An issue was discovered in Serenity Serene and StartSharp before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist...

CVE-2023-31285: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in Serenity Serene and StartSharp before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be sent to an administrator user...