PT-2023-17382 · Unknown · Answerdev/Answer

Name of the Vulnerable Software and Affected Versions: answerdev/answer versions prior to 1.0.8 Description: The issue concerns the exposure of sensitive information through metadata in the answerdev/answer GitHub repository. This exposure can include sensitive data such as EXIF data and GPS...

CVE-2023-1974 Exposure of Sensitive Information Through Metadata in answerdev/answer

Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8...

CVE-2023-1974 Exposure of Sensitive Information Through Metadata in answerdev/answer

Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8...

CVE-2023-1974 Exposure of Sensitive Information Through Metadata in answerdev/answer

Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8...

CVE-2023-1976

CVE-2023-1976 affects answerdev/answer (open-source knowledge-based community software). The root cause is password reset links not expiring, enabling potential account takeover for versions prior to 1.0.6. Exploitation details are not provided in the documents; impact is described as account tak...

CVE-2023-1975

The CVE-2023-1975 entry refers to an information-disclosure flaw in the open-source project answerdev/answer prior to version 1.0.8, where EXIF geolocation data is not stripped from user-uploaded logos. Multiple connected sources (CNVD/CNNVD, GHSA, OSV, NVD, CVE listings) corroborate that an atta...

Answerdev 1.0.3 Account Takeover

Exploit Title: Answerdev 1.0.3 - Account Takeover Date: Reported on Jan 24th 2023 Exploit Author: Eduardo Pérez-Malumbres Cervera @blueudp Vendor Homepage: https://answer.dev/ Software Link: https://github.com/answerdev/answer Version: 1.0.3 Tested on: Ubuntu 22.04 / Debian 11 CVE : CVE-2023-0744...

Answerdev 1.0.3 - Account Takeover

Exploit Title: Answerdev 1.0.3 - Account Takeover Date: Reported on Jan 24th 2023 Exploit Author: Eduardo Pérez-Malumbres Cervera @blueudp Vendor Homepage: https://answer.dev/ Software Link: https://github.com/answerdev/answer Version: 1.0.3 Tested on: Ubuntu 22.04 / Debian 11 CVE : CVE-2023-0744...

Answerdev 1.0.3 - Account Takeover Exploit

Exploit Title: Answerdev 1.0.3 - Account Takeover Exploit Author: Eduardo Pérez-Malumbres Cervera @blueudp Vendor Homepage: https://answer.dev/ Software Link: https://github.com/answerdev/answer Version: 1.0.3 Tested on: Ubuntu 22.04 / Debian 11 CVE : CVE-2023-0744 from sys import argv import...

Answer vulnerable to Stored Cross-site Scripting

Cross-site Scripting XSS - Stored in GitHub repository answerdev/answer prior to 1.0.7...

CVE-2023-1543

Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1542

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1540

Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1535

Cross-site Scripting XSS - Stored in GitHub repository answerdev/answer prior to 1.0.7...

Session fixation

Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1540 Observable Response Discrepancy in answerdev/answer

Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1537 Authentication Bypass by Capture-replay in answerdev/answer

Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6...

PT-2023-17056 · Answerdev · Answer

Name of the Vulnerable Software and Affected Versions: answerdev/answer versions prior to 1.0.7 Description: The issue is related to Stored Cross-site Scripting XSS in the GitHub repository answerdev/answer. This type of attack allows an attacker to inject malicious scripts into a website, which...

CVE-2023-1539 Improper Restriction of Excessive Authentication Attempts in answerdev/answer

Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1543 Insufficient Session Expiration in answerdev/answer

Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6...