Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: ifmeorg ifme unspecified Clear all filters
TI-2021-07997 CVE-2021-25991 · GHSA-9869-mhm7-vvmm

ifme - Improper Access Control leads to admin deactivation

Priority HIGH 65

In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access…

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00829 Published 2021-12-29 No fix listed CWE-284
TI-2021-07996 CVE-2021-25990 · GHSA-f8jj-6823-vfgv

ifme - Stored Cross-Site Scripting (XSS) in Contacts section

Priority MEDIUM 58

In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00636 Published 2021-12-29 No fix listed CWE-79
TI-2021-07995 CVE-2021-25989 · GHSA-5pg4-q67x-c7x9

ifme - Stored Cross-Site Scripting (XSS) in Groups section

Priority MEDIUM 58

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00636 Published 2021-12-29 No fix listed CWE-79
TI-2021-07994 CVE-2021-25988 · GHSA-fwv7-9j7c-rjhr

ifme - Stored Cross-Site Scripting (XSS) in Notifications section

Priority MEDIUM 58

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00636 Published 2021-12-29 No fix listed CWE-79