Vulnerabilities

TI-2023-13204 CVE-2023-28686 · GHSA-xxch-mf4j-qcvj

Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify…

LOW 32

Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00699 Published 2023-03-24 No fix listed CWE-639

TI-2021-13211 CVE-2021-33896 · GHSA-8j28-3ggh-xffw

LOW 28

Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01766 Published 2021-06-07 No fix listed CWE-22

TI-2019-12217 CVE-2019-16235 · GHSA-693v-2qv8-6vvv

LOW 36

Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01377 Published 2019-09-11 No fix listed CWE-346

TI-2019-12218 CVE-2019-16236 · GHSA-g5xx-x6v3-g4g8

LOW 37

Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02385 Published 2019-09-11 No fix listed CWE-862

TI-2019-12219 CVE-2019-16237 · GHSA-q59m-4v4j-9652

LOW 35

Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_management.vala.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01152 Published 2019-09-11 No fix listed CWE-346