Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An Open Redirect vulnerability exists in Taguette that allows attackers to craft malicious URLs that redirect users to arbitrary external websites after authentication. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware. Severity: Medium to High --- Details The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. The vulnerable code is located in two places: Location 1: Login Handler (taguette/web/views.py, lines 140-144) This method is called after successful login (line 132) and when an already-logged-in user visits the login page (line 109). Location 2: Cookies Prompt Handler (taguette/web/views.py, lines 79-85) In both cases, if next is provided by the user, it is passed directly to self.redirect() without checking whether it points to the same host or is a…
Recommended action: Upgrade to 1.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. Patches Users should upgrade to Taguette 1.5.0. References - https://gitlab.com/remram44/taguette/-/issues/330
Recommended action: Upgrade to 1.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. Patches Users should upgrade to Taguette 1.5.0. References - https://gitlab.com/remram44/taguette/-/issues/331
Recommended action: Upgrade to 1.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.