Advisories · Technology
duck-organization quest-bot.
Every CVE that names duck-organization quest-bot among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.3 High
Quest Bot: AutoMod removal can delete rules from another guild by global rule ID
- duck-organization quest-bot
- Broken access control
- CVSS 2.3 Low
Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions.
- duck-organization quest-bot
- CWE-116
- CVSS 5.7 Medium
Quest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channel
- duck-organization quest-bot
- Information disclosure
- CVSS 5.7 Medium
Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel
- duck-organization quest-bot
- Information disclosure
- CVSS 2.3 Low
Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings
- duck-organization quest-bot
- CWE-116
- CVSS 6.3 Medium
Quest Bot: Ticket reason allows mass-mention injection
- duck-organization quest-bot
- CWE-116
- CVSS 9.5 CriticalCritical · CVSS 9+
Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.
- duck-organization quest-bot
- CWE-829
- CVSS 8.8 High
Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`
- duck-organization quest-bot
- CWE-116
- CVSS 7.2 High
Quest Bot: Unprivileged users can create and remove AutoMod rules.
- duck-organization quest-bot
- Broken access control
- CVSS 7.5 High
Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts
- duck-organization quest-bot
- Privilege escalation