Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

15 records

Vendor: decidim Component: Decidim Clear all filters
TI-2024-21125 CVE-2024-32034 · GHSA-rx9f-5ggv-5rh6

Cross-site scripting (XSS) in the decidim admin activity log

Priority LOW 30

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00374 Published 2024-09-16 Fixed in 0.27.7, 0.28.2 CWE-79
TI-2023-25775 CVE-2023-47634 · GHSA-r275-j57c-7mf2

Decidim has race condition in Endorsements

Priority LOW 16

Decidim is a participatory democracy framework.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00444 Published 2024-02-20 Fixed in 0.26.9, 0.27.5 CWE-362
TI-2023-18306 CVE-2023-36465 · GHSA-639h-86hw-qcjq

Decidim has broken access control in templates

Priority MEDIUM 40

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00674 Published 2023-10-06 Fixed in 0.26.8, 0.27.4 CWE-284
TI-2023-16935 CVE-2023-34089 · GHSA-5652-92r9-3fx9

Decidim Cross-site Scripting vulnerability in the processes filter

Priority LOW 39

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00736 Published 2023-07-11 Fixed in 0.26.7, 0.27.3 CWE-79
TI-2023-16936 CVE-2023-34090 · GHSA-jm79-9pm4-vrw9

Decidim vulnerable to sensitive data disclosure

Priority MEDIUM 41

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0126 Published 2023-07-11 Fixed in 0.27.3 CWE-200