HighCVSS 8.3
Missing Authentication for Critical Function in GitHub repository answerdev/answer prior to v1.1.3.
Product
answerdev github.com/answerdev/answer vulnerabilities
34 published CVES affecting answerdev github.com/answerdev/answer, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 34
- Critical
- 6
- High
- 7
- Medium
- 20
- Low
- 1
- Unscored
- 0
- CISA KEV
- 0
Latest answerdev github.com/answerdev/answer CVEs
Newest publication first · page 1 of 2
-
-
MediumCVSS 6.5
Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1.
-
MediumCVSS 4.1
Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0.
-
HighCVSS 8.8
Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0.
-
HighCVSS 8.1
Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.
-
HighCVSS 7.7
Missing Authorization in GitHub repository answerdev/answer prior to 1.0.9.
-
HighCVSS 8.3
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
-
HighCVSS 8.8
answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.6 is vulnerable to account takeover because the password reset link does not expire.
-
MediumCVSS 6.5
answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 does not strip EXIF geolocation data from user-uploaded logos. As a result, anyone can get sensitive information like a user's device ID, geolocation, system information, system version,...
-
MediumCVSS 6.5
answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 may expose sensitive information, such as EXIF data and GPS coordatinates, via image metadata.
-
MediumCVSS 5.3
Guessable CAPTCHA in GitHub repository answerdev/answer prior to 1.0.6.
-
LowCVSS 3.8
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
-
MediumCVSS 5.4
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
-
MediumCVSS 5.3
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
-
HighCVSS 8.8
Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.
-
MediumCVSS 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
-
CriticalCVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.
-
MediumCVSS 5.3
Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
-
MediumCVSS 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
-
MediumCVSS 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
-
MediumCVSS 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
-
MediumCVSS 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
-
MediumCVSS 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
-
MediumCVSS 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
-
MediumCVSS 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.