mesosoi vulnerabilities

Products

• silverwaregames-io-issue-tracker 5

Latest mesosoi CVEs

Newest publication first

1. CVE-2023-40179 Silverware Games vulnerable to account enumeration via inconsistent responses

   Published 2023-08-25

   Medium·CVSS 5.3 EPSS 0.45%

   Silverware Games is a premium social network where people can play games online. Prior to version 1.3.6, the Password Recovery form would throw an error if the specified email was not found in our database. It would only display the "Enter the code" form if the email is associate...

2. CVE-2023-40182 silverware-io-issue-tracker server responds in a noticeably different amount of time depending if a given email address exists or not

   Published 2023-08-25

   Medium·CVSS 5.3 EPSS 0.39%

   Silverware Games is a premium social network where people can play games online. When using the Recovery form, a noticeably different amount of time passes depending of whether the specified email address presents in our database or not. This has been fixed in version 1.3.7.

3. CVE-2023-29192 SilverwareGames.io users with access to the game upload panel are able to edit download links for games uploaded by other developers

   Published 2023-04-10

   Medium·CVSS 4.3 EPSS 0.39%

   SilverwareGames.io versions before 1.2.19 allow users with access to the game upload panel to edit download links for games uploaded by other developers. This has been fixed in version 1.2.19.

4. CVE-2022-23543 HTML attributes when attaching a YouTube link to the post

   Published 2022-12-19

   Medium·CVSS 5.4 EPSS 0.36%

   Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate related <iframe> when the post will be published. The handler has some sort of protection so non-YouTube links can't be posted, as well as HTML...

5. CVE-2022-36072 SilverwareGames.io used == for hashing instead of ===

   Published 2022-09-06

   Medium·CVSS 5.9 EPSS 0.57%

   SilverwareGames.io is a social network for users to play video games online. In version 1.1.8 and prior, due to an unobvious feature of PHP, hashes generated by built-in functions and starting with the 0e symbols were being handled as zero multiplied with the e number. Therefore,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.