CVE-2021-25989

Summary: CVE-2021-25989 affects the Ifme application. Vulnerability: stored XSS in the Markdown editor affecting versions 1.0.0 through 7.31.4. The payload can be triggered when a user is made a Leader of a group, according to the linked entries. Root cause (as described): lack of input/data vali...

CVE-2021-25988 ifme - Stored Cross-Site Scripting (XSS) in Notifications section

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability notifications section which can be directly triggered by sending an ally request to the admin...

CVE-2021-25988

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability notifications section which can be directly triggered by sending an ally request to the admin...

CVE-2021-25988 ifme - Stored Cross-Site Scripting (XSS) in Notifications section

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability notifications section which can be directly triggered by sending an ally request to the admin...

CVE-2021-25988

The CVE-2021-25988 issue affects the open-source project ifme, with vulnerable versions 1.0.0 through v7.31.4. Reported as a stored XSS vulnerability in the notifications section that can be triggered by sending an ally request to an administrator. The root cause is described as lack of checksum ...

PT-2021-16912

Name of the Vulnerable Software and Affected Versions ifme versions 1.0.0 through 7.31.4 Description The issue is related to a stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group, which triggers the payload for them. Recommendations For...

CVE-2021-25991: Improper Access Control

In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme...

CVE-2021-25990: Improper Neutralization of Input During Web Page Generation

In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe...

PT-2021-16911

Name of the Vulnerable Software and Affected Versions ifme versions 1.0.0 through 7.31.4 Description The issue concerns a stored XSS vulnerability in the notifications section, which can be triggered by sending an ally request to the admin. Recommendations For versions 1.0.0 through 7.31.4,...

Ifme 跨站脚本漏洞

Ifme is open source a mental health experience community that encourages people to share their personal stories with trusted allies. A cross-site scripting vulnerability exists in ifme that stems from the product's markdown editor not doing valid validation of input data. An attacker could trigge...

CVE-2021-25989: Improper Neutralization of Input During Web Page Generation

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them...

PT-2021-16913

Name of the Vulnerable Software and Affected Versions ifme versions v7.22.0 through v7.31.4 Description The issue concerns self-stored XSS in the contacts field, allowing the loading of XSS payloads fetched via an iframe. Recommendations For versions v7.22.0 through v7.31.4, consider disabling th...

PT-2021-16914

Name of the Vulnerable Software and Affected Versions Ifme versions v5.0.0 through v7.32 Description The issue is related to improper access control, allowing admins to ban themselves. This leads to deactivation from the Ifme account and complete loss of admin access to Ifme. Recommendations For...

Ifme 跨站脚本漏洞

Ifme is open source a mental health experience community that encourages people to share their personal stories with trusted allies. Ifme suffers from a cross-site scripting vulnerability in versions v7.22.0 through v7.31.4, which stems from a lack of checksum filtering of user-supplied data and...

Ifme 跨站脚本漏洞

Ifme is open source a mental health experience community that encourages people to share their personal stories with trusted allies. Ifme suffers from a cross-site scripting vulnerability in versions v1.0.0 through v7.31.4, which stems from a lack of checksum filtering of user-supplied and output...

CVE-2021-25988: Improper Neutralization of Input During Web Page Generation

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability notifications section which can be directly triggered by sending an ally request to the admin...