answer - MidnightBSD Security Advisories

CVE-2023-0739

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1.0.4.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.8	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H	1.6	5.2

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-0740

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	2.3	6.0

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-0741

Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	2.3	6.0

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-0742

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	2.3	6.0

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-0743

Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	2.3	6.0

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-0744

Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-0934

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.5.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1237

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1238

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1239

Cross-site Scripting (XSS) - Reflected in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	4.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	1.7	2.7

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1240

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1241

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1242

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1243

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	4.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	1.7	2.7

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1244

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1245

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1535

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1536

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1537

Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1538

Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1539

Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1540

Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1541

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	3.8	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L	1.2	2.5

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1542

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L	2.8	2.5

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1543

Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1974

Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8.

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1975

Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8.

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-1976

Password Aging with Long Expiration in GitHub repository answerdev/answer prior to 1.0.6.

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-2590

Missing Authorization in GitHub repository answerdev/answer prior to 1.0.9.

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-4124

Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-4125

Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0.

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-4126

Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0.

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-4127

Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1.

Products Affected

Vendor	Product	Version
answer	answer	*

CVE-2023-4815

Missing Authentication for Critical Function in GitHub repository answerdev/answer prior to v1.1.3.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9

Products Affected

Vendor	Product	Version
answer	answer	*

Advisories for answer