PT-2023-17383 · Unknown · Answerdev/Answer

Name of the Vulnerable Software and Affected Versions: answerdev/answer versions prior to 1.0.8 Description: The issue concerns the insertion of sensitive information into sent data. Specifically, answerdev/answer, an open-source knowledge-based community software, does not strip EXIF geolocation...

CVE-2023-1976 Password Aging with Long Expiration in answerdev/answer

Password Aging with Long Expiration in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1976

CVE-2023-1976 affects answerdev/answer (open-source knowledge-based community software). The root cause is password reset links not expiring, enabling potential account takeover for versions prior to 1.0.6. Exploitation details are not provided in the documents; impact is described as account tak...

CVE-2023-1975

The CVE-2023-1975 entry refers to an information-disclosure flaw in the open-source project answerdev/answer prior to version 1.0.8, where EXIF geolocation data is not stripped from user-uploaded logos. Multiple connected sources (CNVD/CNNVD, GHSA, OSV, NVD, CVE listings) corroborate that an atta...

CVE-2023-1974 Exposure of Sensitive Information Through Metadata in answerdev/answer

Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8...

CVE-2023-1974 Exposure of Sensitive Information Through Metadata in answerdev/answer

Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8...

The vulnerability of the `answer_request` function in the `fuzz_rfc1035.c` component of the DNS server Dnsmasq allows a hacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the answerrequest function in the fuzzrfc1035.c component of the DNS server Dnsmasq is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

Answer vulnerable to Stored Cross-site Scripting

Cross-site Scripting XSS - Stored in GitHub repository answerdev/answer prior to 1.0.7...

CVE-2023-1543

Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1542

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1540

Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1535

Cross-site Scripting XSS - Stored in GitHub repository answerdev/answer prior to 1.0.7...

Session fixation

Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1538 Observable Timing Discrepancy in answerdev/answer

Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1540

CVE-2023-1540 concerns the open‑source knowledgebase app answerdev/answer prior to version 1.0.6. The vulnerability is described as an observable response discrepancy in the GitHub repository’s Answer before 1.0.6, enabling information disclosure during the password reset flow: an attacker could ...

CVE-2023-1536

CVE-2023-1536 describes a stored Cross-site Scripting (XSS) vulnerability in the GitHub repository answerdev/answer for versions prior to 1.0.7 . The issue arises from user-supplied input being stored and subsequently reflected, enabling an attacker to execute script in an authenticated user’s co...

CVE-2023-1541

CVE-2023-1541 affects the open-source project answerdev/answer prior to version 1.0.6. The issue is a Business Logic Error arising from improper permission handling in the password-reset workflow (the /answer/admin/api/user/password path). An attacker with low privileges can modify the user_id pa...

CVE-2023-1543 Insufficient Session Expiration in answerdev/answer

Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1538 Observable Timing Discrepancy in answerdev/answer

Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1539

CVE-2023-1539 affects the GitHub repository answerdev/answer : versions prior to 1.0.6 have an improper restriction of excessive authentication attempts and a guessable CAPTCHA. Root cause: insufficient controls on repeated authentication attempts (exact technical details not expanded beyond what...