All CVEs — page 320 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
A privilege escalation flaw in Plane allows workspace members to access private project assets they shouldn't be able to view, potentially exposing sensitive issue or comment descriptions from unpublished projects. This affects versions prior to 1.4.0.
The flaw allows an authenticated low-privilege user to upload an SVG file that can execute JavaScript, leading to potential session hijacking and account takeover.
Plane's OAuth avatar synchronization feature was vulnerable to server-side request forgery (SSRF) that allowed attackers to fetch internal resources and expose them via public asset URLs. This could lead to information disclosure of internal system data.
The flaw allows any authenticated user to inject arbitrary HTML, leading to potential JavaScript execution and API token exfiltration when clicked by a project member or viewer.
The flaw allows any authenticated user to join a project by knowing the workspace slug and project ID, and an attacker can register an account without mailbox verification to accept the invitation, gaining unauthorized access to the project.