TI-2021-07998 CVE-2021-25992 · GHSA-xmp3-76fc-6jhm
ifme - Insufficient Session Expiration
Priority MEDIUM 45
In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout.
Vulnerabilities
5 records
TI-2021-07997 CVE-2021-25991 · GHSA-9869-mhm7-vvmm
ifme - Improper Access Control leads to admin deactivation
Priority HIGH 65
In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access…
TI-2021-07996 CVE-2021-25990 · GHSA-f8jj-6823-vfgv
ifme - Stored Cross-Site Scripting (XSS) in Contacts section
Priority MEDIUM 58
In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.
TI-2021-07995 CVE-2021-25989 · GHSA-5pg4-q67x-c7x9
ifme - Stored Cross-Site Scripting (XSS) in Groups section
Priority MEDIUM 58
In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor.
TI-2021-07994 CVE-2021-25988 · GHSA-fwv7-9j7c-rjhr
ifme - Stored Cross-Site Scripting (XSS) in Notifications section
Priority MEDIUM 58
In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin.