Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
34 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Missing Authentication for Critical Function in GitHub repository answerdev/answer prior to v1.1.3.
Recommended action: Upgrade to 1.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1.
Recommended action: Upgrade to 1.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.
Recommended action: Upgrade to 1.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0.
Recommended action: Upgrade to 1.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0.
Recommended action: Upgrade to 1.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing authorization in GitHub repository answerdev/answer prior to 1.0.9 can lead to a user rating their own answer as the best answer.
Recommended action: Upgrade to 1.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 may expose sensitive information, such as EXIF data and GPS coordatinates, via image metadata.
Recommended action: Upgrade to 1.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 does not strip EXIF geolocation data from user-uploaded logos. As a result, anyone can get sensitive information like a user's device ID, geolocation, system information, system version, etc.
Recommended action: Upgrade to 1.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.6 is vulnerable to account takeover because the password reset link does not expire.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
Recommended action: Upgrade to 1.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
Recommended action: Upgrade to 1.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Guessable CAPTCHA in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Reflected in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.