Design/Logic Flaw

fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to...

CVE-2022-35921 User preference to prevent private discussions not respected in fof/byobu

fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to...

CVE-2022-35921

fof/byobu is a private discussions extension for Flarum. The issue: private discussion disablement is not respected, risking leakage of private discussions. A patch exists in version 1.1.7, and users of Byobu with Flarum 1.0 or 1.1 should upgrade to Flarum 1.2 or later, or disable the extension i...

CVE-2022-35921 User preference to prevent private discussions not respected in fof/byobu

fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to...

CVE-2022-35921 User preference to prevent private discussions not respected in fof/byobu

fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to...

Flarum 安全漏洞

Flarum is an open source forum system for the Flarum community. A security vulnerability exists in Flarum's Byobu extension prior to version 1.1.7, which stems from the fact that Byobu is a private discussion extension for the Flarum forums, and the affected version was found to not allow private...

PT-2022-23027 · Flarum +2 · Flarum +2

Name of the Vulnerable Software and Affected Versions: fof/byobu versions prior to 1.1.7 Description: The issue concerns the fof/byobu private discussions extension for Flarum forum, where affected versions do not respect private discussion disablement by users. This means users who have chosen t...

GHSA-FM53-MPMP-7QW2 Possible cross-site scripting attack via unsanitized SVG files in FoF Upload

Impact If FoF Upload is configured to allow the uploading of SVG files image/svg+xml, navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service...

GHSA-G6W5-439M-JHWV Flarum mishandles invalidation of user email tokens

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens...

Flarum mishandles invalidation of user email tokens

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens...

Flarum Core Leaks PII

In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address...

GHSA-P6M5-X83R-HQMR Flarum Core Leaks PII

In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address...

in flarum/framework

Description Sensitive Data can be exposed even after logouting the application due to ui wrong action Proof of Concept 1 login to the application dashboard as admin https://demo.flarum.site/admin/ 2 Goto Any pages dashboard,permissions etc 3 Click logout 4 Click browser back button 5 Will Re-ente...

in flarum/framework

✍️ Description Avatar URL from OAuth registration is passed to Intervention Image's ImageManager::make function without any validation on URL. Since ImageManager::make allows relative path to read file, it is possible to inject arbitrary inputs like storage/somefile.jpg or even absolute paths like...

Flarum Cross-Site Scripting Vulnerability

Flarum and others are products of the Flarum Flarum community. flarum is an open source forum system. Flarum has a cross-site scripting vulnerability that can be exploited by attackers to inject HTML code...

CVE-2021-32671

Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 our last beta before v1.0.0 and was not noticed or documented. This allowed for any user to type...

CVE-2021-32671

Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 our last beta before v1.0.0 and was not noticed or documented. This allowed for any user to type...

CVE-2021-32671

Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 our last beta before v1.0.0 and was not noticed or documented. This allowed for any user to type...

Design/Logic Flaw

Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 our last beta before v1.0.0 and was not noticed or documented. This allowed for any user to type...

GHSA-5QJQ-69W6-FG57 XSS vulnerability with translator

Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 our last beta before v1.0.0 and was not noticed or documented. This allowed for any user to type malicious HTML markup within certain user input field...