Cerebrate-project Security Vulnerabilities

CVE-2022-25317

An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.

CVE-2022-25318

An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groups.

CVE-2022-25319

An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.

CVE-2022-25320

An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.

CVE-2022-25321

An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.

CVE-2023-26468

Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.

CVE-2023-28883

In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.

CVE-2023-41363

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.

CVE-2023-41908

Cerebrate before 1.15 lacks the Secure attribute for the session cookie.