455 matches found
PT-2017-13894
Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.47 Description The issue allows an authenticated user to add a new task to a private project of another user by altering form data. Recommendations For versions prior to 1.0.47, update to version 1.0.47 or later ...
PT-2017-13895
Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.47 Description The issue allows an authenticated user to edit tags of a private project belonging to another user by altering form data. Recommendations For versions prior to 1.0.47, update to version 1.0.47 or...
PT-2017-13896
Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.47 Description The issue allows an authenticated user to edit columns of a private project belonging to another user by altering form data. Recommendations For versions prior to 1.0.47, update to version 1.0.47 o...
PT-2017-13892
Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.47 Description The issue allows an authenticated user to edit metadata of a private project belonging to another user by altering form data. This can be demonstrated through modifications to fields such as Name,...
PT-2017-13897
Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.47 Description The issue allows an authenticated user to remove categories from a private project of another user by altering form data. Recommendations For versions prior to 1.0.47, update to version 1.0.47 or...
PT-2017-13890
Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.47 Description The issue allows an authenticated user to add a new category to a private project of another user by altering form data. Recommendations For versions prior to 1.0.47, update to version 1.0.47 or...
PT-2017-13889
Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.47 Description The issue allows an authenticated user to remove columns from a private project of another user by altering form data. Recommendations For versions prior to 1.0.47, update to version 1.0.47 or late...
PT-2017-13903
Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.47 Description The issue allows an authenticated user to remove attachments from a private project of another user by altering form data. Recommendations For versions prior to 1.0.47, update to version 1.0.47 or...
PT-2017-13900
Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.47 Description The issue allows an authenticated user to add an internal link to a private project of another user by altering form data. Recommendations For versions prior to 1.0.47, update to version 1.0.47 or...
PT-2017-13907
Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.47 Description The issue allows an authenticated user to see the names of tags of a private project of another user by altering form data. Recommendations For versions prior to 1.0.47, update to version 1.0.47 or...
PT-2017-13906
Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.47 Description The issue allows an authenticated user to add an external link to a private project of another user by altering form data. Recommendations For versions prior to 1.0.47, update to version 1.0.47 or...
PT-2017-13899
Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.47 Description The issue allows an authenticated user to download attachments from a private project of another user by altering form data. Recommendations For versions prior to 1.0.47, update to version 1.0.47 o...
GitLab: GFM renderer leaks external issue tracker URL of private project
Vulnerability details The GFM renderer has the ability to cross-link issues between projects. When this project is private and the user doesn't have access, the link isn't made. This is good. However, when the private project has an external issue tracker set up, an attacker can extract the...
