repository icon
wallabag / wallabag Project repository

wallabag is a self hostable application for saving web pages: Save and classify articles. Read them later. Freely.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN38 DAYS

FIX

WITHIN46 DAYS

Unauthorized Access Handling Misconfiguration
nithisssh
not applicable
Authentication cookie without Secure flag
uonghoangminhchau
Medium
CSRF leading to delete Client API in API clients management
tht1997
Medium
•CVE-2023-4455
Several CSRFs in Reset Area and Delete Entry Action
zpbrent
Medium
•CVE-2023-4454
Account Takeover via Password Brute-Force
thewhiteevil
pending
XSS Stored in entry links
xanhacks
pending
CSRF to remove all entries
zoro2000
pending
Host Header Poisoing on Reset Password Request Lead to Account Takeover
sl4x0
pending
Weak Password Implementation leads to Account Takeover
sl4x0
pending
UI REDRESSING
ctflearner
pending
Two factor authentication bypass
rutvikhajare
pending
No limit in length of "Name" parameter results in DOS attack /memory corruption
ctflearner
self closed
Email Verification Bypass via resetting password on app.wallbag.it
rutvikhajare
pending
No Rate limit on Login page
ctflearner
pending
Weak Password Policy
ctflearner
pending
GET based CSRF on all the reset functionalities
leorac
pending
GET based CSRF on delete user functionality
leorac
Medium
•CVE-2023-0735
Email confirmation bypass thought update profile functionality
leorac
pending
Stored XSS on shared link via username
leorac
duplicate
Medium
IDOR Vulnerability Allows add tag entry user other
juylang
High
•CVE-2023-0734
Stored Cross Site Scripting in the username
gabriel-vernilo
Medium
•CVE-2023-0736
IDOR vulnerability allowing to update another user's annotations
bauh0lz
Medium
•CVE-2023-0610
Reverse Tabnabbing
bauh0lz
pending
IDOR allowing to see other users' entries
bauh0lz
Medium
•CVE-2023-0609
CSRF leading to delete account
bauh0lz
Medium
•CVE-2023-0737
Improper Restriction of Rendered UI Layers or Frames
bauh0lz
pending
Cross-site Scripting (XSS) - Stored
416e6e61
pending
Improper Restriction of Rendered UI Layers or Frames
melbinkm
pending
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
melbinkm
pending