Wekan 跨站脚本漏洞

Wekan is a website builder from the Wekan team that provides the ability to make planning lists and plan time. A security vulnerability exists in Wekan version v6.84. An attacker exploiting the vulnerability can insert JavaScript code...

CVE-2023-31779

Wekan v6.84 and earlier is vulnerable to Cross Site Scripting XSS. An attacker with user privilege on kanban board can insert JavaScript code in in "Reaction to comment" feature...

CVE-2023-31779

Wekan v6.84 and earlier is vulnerable to Cross‑Site Scripting (XSS) via the "Reaction to comment" feature. A user with board privileges can inject JavaScript in responses to comments, with the exploit scenario noting potential token theft (e.g., Meteor.loginToken) and page content changes for phi...

Wekan Cross-Site Scripting Vulnerability

Wekan is a highly finished open source kanban tool. wekan suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in WEB applications. An attacker could exploit the vulnerability to execute malicious javascript code...

CVE-2021-20654

Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scripting. This is named 'Fieldbleed' in the vendor's site...

CVE-2021-20654

Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scripting. This is named 'Fieldbleed' in the vendor's site...

Cross site scripting

Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scripting. This is named 'Fieldbleed' in the vendor's site...

CVE-2021-20654

Wekan (versions 3.12–4.11) is vulnerable to multiple stored cross-site scripting (Fieldbleed). Root cause cited as improper validation of client-side data leading to CWE-79. Impact: a logged-in user can store malicious input that executes JavaScript in other users’ browsers. Remediation: update t...

CVE-2021-20654

Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scripting. This is named 'Fieldbleed' in the vendor's site...

Wekan vulnerable to cross-site scripting

Overview Wekan, open source kanban board system, is vulnerable to cross-site scripting CWE-79. This vulnerability is treated as one of multiple cross-site scripting vulnerabilities, named "Fieldbleed". Ryoya Koyama at Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA...

Wekan 跨站脚本漏洞

Wekan is a highly finished open source kanban tool. wekan suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in WEB applications. An attacker could exploit the vulnerability to execute malicious javascript code...

JVN#80785288: Wekan vulnerable to cross-site scripting

Wekan, open source kanban board system, is vulnerable to cross-site scripting CWE-79. This vulnerability is treated as one of multiple cross-site scripting vulnerabilities, named "Fieldbleed". Impact When a logged-in user store malicious value containing Javascript code to the system, that...

CVE-2021-3309

packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,...

CVE-2021-3309

packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,...

Code injection

packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,...

CVE-2021-3309

packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,...

CVE-2021-3309

CVE-2021-3309 affects the Wekan LDAP integration: the module at packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections that are not authorized by the Certification Authority trust store, due to improper CA trust verification. This vulnerability could impact confidentialit...

CVE-2021-3309

packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,...

Wekan Trust Management Issue Vulnerabilities

Wekan is a website builder system from the Wekan team that provides the ability to make planning lists and plan time. A trust management issue vulnerability exists in Wekan before 4.87, which stems from the fact that packages/wekan-ldap/server/ldap.js can handle connections when unauthorized...

CVE-2018-1000549

Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.. This attack appear to be exploitable via HTTP Request...