code.vikunja.io/api vulnerabilities (Go)
67 vulnerabilities.
code.vikunja.io/apiGoWebhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API6.5 Mediumcode.vikunja.io/apiGoVikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read6.5 Mediumcode.vikunja.io/apiGoVikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources6.4 Mediumcode.vikunja.io/apiGoVikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect7.1 Highcode.vikunja.io/apiGoVikunja Affected by DoS via Image Preview Generation6.5 Mediumcode.vikunja.io/apiGoVikunja has TOTP Reuse During Validity Window5.7 Mediumcode.vikunja.io/apiGoVikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement8.1 Highcode.vikunja.io/apiGoVikunja has a 2FA Bypass via Caldav Basic Auth6.9 Mediumcode.vikunja.io/apiGoVikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments5.3 Mediumcode.vikunja.io/apiGoRead-only Vikunja users can delete project background images via broken object-level authorization5.3 Mediumcode.vikunja.io/apiGoVikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers5.3 Mediumcode.vikunja.io/apiGoVikunja Vulnerable to Account Takeover via Password Reset Token Reuse9.8 Criticalcode.vikunja.io/apiGoVikunja has Path Traversal in CLI Restore7.2 Highcode.vikunja.io/apiGoVikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure7.3 Highcode.vikunja.io/apiGoVijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change9.1 Criticalcode.vikunja.io/apiGoVikunja has Reflected HTML Injection via filter Parameter in Projects Module6.1 Mediumcode.vikunja.io/apiGoVikunja Affected by XSS Via Task Preview8.6 High