Kaj Magnus Lindberg

3 exploits Active since Nov 2021
CVE-2021-25981 WRITEUP CRITICAL WRITEUP
Talkyard 0.2021.20-0.2021.33 - Insufficient Session Expiration
In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)
CVSS 9.8
CVE-2021-25980 WRITEUP HIGH WRITEUP
Talkyard 0.04.01-0.6.74-WIP-63220cb - Host Header Injection via Forgot Password Functionality
In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
CVSS 8.8
CVE-2021-25981 WRITEUP CRITICAL WRITEUP
Talkyard 0.2021.20-0.2021.33 - Insufficient Session Expiration
In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)
CVSS 9.8