CVE-2021-25980 Talkyard - Host-Header Injection Leads to Account Takeover

In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...

CVE-2021-25980

CVE-2021-25980 describes a Host Header Injection vulnerability in Talkyard. Affected versions include v0.04.01–v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e–v0.2021.02-WIP-879ef3fe1, and tyse-v0.2021.02–tyse-v0.2021.28-af66b6905-regular. An unauthenticated attacker can lure a user to click a link...

PT-2021-16904

Name of the Vulnerable Software and Affected Versions Talkyard versions v0.04.01 through v0.6.74-WIP-63220cb Talkyard versions v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 Talkyard versions tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular Description The...

CVE-2021-25980: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, a...

Talkyard 注入漏洞

Talkyard is an open source, structured discussion platform that brings together the key features of StackOverflow, Slack, Discourse, Reddit/HackerNews and Disqus blog comments. Talkyard suffers from a security vulnerability that allows an unauthenticated attacker to use the forgot password featur...