Cerebrate-Project: Security Vulnerabilities
Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
CVSS Score
5.3
EPSS Score
0.001
Published
2023-09-05
In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.
CVSS Score
4.3
EPSS Score
0.001
Published
2023-08-29
In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.
CVSS Score
9.8
EPSS Score
0.001
Published
2023-03-27
Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.
CVSS Score
9.1
EPSS Score
0.001
Published
2023-02-24
An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.
CVSS Score
6.1
EPSS Score
0.002
Published
2022-02-18
An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groups.
CVSS Score
4.3
EPSS Score
0.001
Published
2022-02-18
An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.
CVSS Score
5.3
EPSS Score
0.004
Published
2022-02-18
An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.
CVSS Score
5.3
EPSS Score
0.002
Published
2022-02-18
An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.
CVSS Score
6.1
EPSS Score
0.004
Published
2022-02-18