Search
Search Results (23 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-15156 | 1 Nodebb | 1 Blog Comments | 2024-11-21 | 6.8 Medium |
| In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation. | ||||
| CVE-2020-15149 | 1 Nodebb | 1 Nodebb | 2024-11-21 | 9.9 Critical |
| NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3. | ||||
| CVE-2015-9286 | 1 Nodebb | 1 Nodebb | 2024-11-21 | N/A |
| Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS. | ||||