PT-2023-23962 · Unknown · Tgstation-Server

Name of the Vulnerable Software and Affected Versions: tgstation-server versions 4.7.0 through 5.12.1 Description: The issue allows instance users with the list chat bots permission to read chat bot connection strings without the required permission. This affects a significant number of devices,...

tgstation-server 安全漏洞

tgstation-server is a toolset for managing production BYOND servers. A security vulnerability exists in tgstation-server versions prior to 4.7.0 through 5.12.1, which stems from overstepping the authority to read chatbot connection strings...

GHSA-7R36-JF3C-JHP4 Duplicate Advisory: tgstation-server vulnerable to cached user logins in legacy server

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-42r6-p4px-qvv6. This link is maintained to preserve external references. Original Description In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 fixed in 3.2.5.0, active logins would be cached, allowing...

Duplicate Advisory: tgstation-server vulnerable to cached user logins in legacy server

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-42r6-p4px-qvv6. This link is maintained to preserve external references. Original Description In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 fixed in 3.2.5.0, active logins would be cached, allowing...

tgstation-server Resource Management Error Vulnerability

tgstation-server is a toolset for managing production BYOND servers. A resource management error vulnerability exists in tgstation-server versions 4.4.0 and 4.4.1. The vulnerability stems from the mismanagement of system resources e.g., memory, disk space, files, etc. by a networked system or...

CVE-2020-16136

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine accessible by the owner of the server process via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files,...

CVE-2020-16136

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine accessible by the owner of the server process via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files,...

Directory traversal

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine accessible by the owner of the server process via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files,...

CVE-2020-16136

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine accessible by the owner of the server process via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files,...

CVE-2020-16136

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can access any file on the server machine (accessible by the server process owner) via directory traversal ../ sequences in /Administration/Logs/. The vulnerability enables directory traversal but does not...

CVE-2018-17107

CVE-2018-17107 concerns Tgstation tgstation-server versions 3.2.4.0 through 3.2.1.0, with a fix in 3.2.5.0. The issue arises from active logins being cached, which can allow a subsequent login to succeed with any username or password. The connected documents confirm the vulnerability is a histori...

PT-2018-13900 · Tgstation · Tgstation-Server

Name of the Vulnerable Software and Affected Versions: tgstation-server versions 3.2.1.0 through 3.2.4.0 Description: The issue allows active logins to be cached, enabling subsequent logins to succeed with any username or password. This is due to a bug in the WCF communication layer, where the...