Mattermost Jira Plugin does not properly check security levels

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues...

GHSA-QR8F-CJW7-838M Mattermost Jira Plugin does not properly check security levels

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues...

CVE-2024-24774

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues...

Design/Logic Flaw

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues...

CVE-2024-24774 Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues...

CVE-2024-24774 Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues...

HTML Injection

grumpydictator/firefly-iii is vulnerable to HTML Injection. The vulnerability is caused due to improper sanitization in webhooks features. This allows an attacker to inject malicious HTML content by submitting specially crafted input...

Wordfence Intelligence Weekly WordPress Vulnerability Report (December 18, 2023 to December 31, 2023)

Wordfence just launched its bug bounty program. For the first 6 months, all awarded bounties receive a 10% bonus. View the announcement to learn more now! Over the last two weeks, there were 263 vulnerabilities disclosed in 217 WordPress Plugins and 3 WordPress themes that have been added to the...

GHSA-VWV2-9WCJ-64VX Firefly III allows webhooks HTML Injection.

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

Firefly III allows webhooks HTML Injection.

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

Design/Logic Flaw

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

Firefly III Security Vulnerability

Firefly III is an open source personal finance management system. A security vulnerability exists in Firefly III before 6.1.1, which stems from allowing webhooks HTML injection...

CVE-2024-22075

Firefly III before 6.1.1 allows HTML Injection via webhooks due to improper sanitization in webhook handling. Affected product: Firefly III (web application). Root cause: inadequate sanitization of webhook inputs leading to HTML injection. Impact: potential exposure/impact limited to confidential...

PT-2024-19186 · Unknown · Firefly-Iii

Name of the Vulnerable Software and Affected Versions: Firefly III versions prior to 6.1.1 Description: The issue allows for HTML injection in webhooks. It is related to a Client-Side Path Traversal CSPT vulnerability, which can be used to control data that was assumed to be uncontrollable. This...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

HackerOne: Server Side Request Forgery (SSRF) in webhook functionality

Server Side Request Forgery SSRF vulnerability found in webhook functionality. Attacker able to bypass anti-SSRF protections by using IPv6 address mapped to IPv4. This allowed unauthorized access to internal AWS EC2 metadata instance...

Denial Of Service (DoS)

@octokit/webhooks is vulnerable to Denial Of Service DoS. The vulnerability is caused by a lack of exception handling in the verifyAndReceive method within src/verify-and-receive.ts. This method internally calls another method verify which throws an exception which remains unhandled. This uncaugh...

CVE-2023-50728

An uncaught exception vulnerability was found in octokit webhooks. An error may be undefined in some cases, and the resulting request can cause an uncaught exception that ends the nodejs process...