68 matches found
CVE-2023-33198 Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API
tgstation-server is a production scale tool for BYOND server management. The DreamMaker API DMAPI chat channel cache can possibly be poisoned by a tgstation-server TGS restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the...
tgstation-server 安全漏洞
tgstation-server is a toolset for managing production BYOND servers. A security vulnerability exists in tgstation-server that stems from problematic TGS restarts and reconnections...
CVE-2023-33198: Incorrectly Specified Destination in a Communication Channel
tgstation-server is a production scale tool for BYOND server management. The DreamMaker API DMAPI chat channel cache can possibly be poisoned by a tgstation-server TGS restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the...
PT-2023-24215 · Discord · Discord
Name of the Vulnerable Software and Affected Versions: tgstation-server affected versions not specified Description: The issue concerns the DreamMaker API DMAPI chat channel cache in tgstation-server, which can be poisoned upon a restart and reattach of the server. This can lead to chat messages...
CVE-2023-32687
tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...
Code injection
tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...
CVE-2023-32687
CVE-2023-32687 affects tgstation-server versions 4.7.0 through 5.12.1, where users with the public list chat bots permission can read chat bot connection strings without the required permission. The issue is patched in version 5.12.1. Remediation: update to 5.12.1; as a workaround, remove the lis...
CVE-2023-32687 Insufficiently Protected ChatBot Credentials in tgstation-server
tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...
CVE-2023-32687 Insufficiently Protected ChatBot Credentials in tgstation-server
tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...
CVE-2023-32687
tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...
PT-2023-23962 · Unknown · Tgstation-Server
Name of the Vulnerable Software and Affected Versions: tgstation-server versions 4.7.0 through 5.12.1 Description: The issue allows instance users with the list chat bots permission to read chat bot connection strings without the required permission. This affects a significant number of devices,...
tgstation-server 安全漏洞
tgstation-server is a toolset for managing production BYOND servers. A security vulnerability exists in tgstation-server versions prior to 4.7.0 through 5.12.1, which stems from overstepping the authority to read chatbot connection strings...
CVE-2023-32687: Insufficiently Protected Credentials
tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...
GHSA-7R36-JF3C-JHP4 Duplicate Advisory: tgstation-server vulnerable to cached user logins in legacy server
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-42r6-p4px-qvv6. This link is maintained to preserve external references. Original Description In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 fixed in 3.2.5.0, active logins would be cached, allowing...
Duplicate Advisory: tgstation-server vulnerable to cached user logins in legacy server
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-42r6-p4px-qvv6. This link is maintained to preserve external references. Original Description In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 fixed in 3.2.5.0, active logins would be cached, allowing...
tgstation-server Resource Management Error Vulnerability
tgstation-server is a toolset for managing production BYOND servers. A resource management error vulnerability exists in tgstation-server versions 4.4.0 and 4.4.1. The vulnerability stems from the mismanagement of system resources e.g., memory, disk space, files, etc. by a networked system or...
CVE-2020-16136
In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine accessible by the owner of the server process via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files,...
CVE-2020-16136
In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine accessible by the owner of the server process via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files,...
Directory traversal
In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine accessible by the owner of the server process via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files,...
CVE-2020-16136
In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine accessible by the owner of the server process via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files,...