github.com/lin-snow/Ech0
Go · بسته
اطلاعرسانی آسیبپذیری
دنبالکردن| گزارش | محصول | اکوسیستم | شدت | وضعیت اصلاح | آخرین تغییر |
|---|---|---|---|---|---|
| Ech0 comment model's Email field returned on public /api/comments endpoints | github.com/lin-snow/Ech0github.com/lin-snow/ech0 | Go | متوسط | اصلاح گزارش شده | |
| ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI | github.com/lin-snow/Ech0github.com/lin-snow/ech0 | Go | زیاد | اصلاح گزارش شده | |
| Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers | github.com/lin-snow/Ech0github.com/lin-snow/ech0 | Go | متوسط | اصلاح گزارش شده | |
| Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count | github.com/lin-snow/Ech0github.com/lin-snow/ech0 | Go | متوسط | اصلاح گزارش شده | |
| Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft | github.com/lin-snow/Ech0github.com/lin-snow/ech0 | Go | زیاد | اصلاح گزارش شده |