Advisories · Technology
Kovah LinkAce.
Every CVE that names Kovah LinkAce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.3 High
LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API
- Kovah LinkAce
- Cross-site scripting (XSS)
- CVSS 7.1 High
LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes
- Kovah LinkAce
- Broken access control
- CVSS 8.5 High
LinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session Hijacking
- Kovah LinkAce
- Cross-site scripting (XSS)
- CVSS 8.1 High
LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances
- Kovah LinkAce
- Other injection
- CVSS 8.1 High
LinkAce: Password Reset Poisoning via X-Forwarded-Host Header Injection Leading to Account Takeover
- Kovah LinkAce
- Open redirect
- CVSS 5.0 Medium
LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection
- Kovah LinkAce
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
LinkAce discloses private notesto unauthorized authenticated users via the web link detail page
- Kovah LinkAce
- Broken access control
- CVSS 8.5 High
LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce
- Kovah LinkAce
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy()
- Kovah LinkAce
- Broken access control
- CVSS 7.7 High
LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest
- Kovah LinkAce
- Server-side request forgery (SSRF)
- CVSS 8.7 High
LinkAce: Stored XSS in Atom Feed via CDATA Escape in List Description
- Kovah LinkAce
- Cross-site scripting (XSS)
- CVSS 8.7 High
LinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing Feature
- Kovah LinkAce
- Cross-site scripting (XSS)
- CVSS 7.1 High
LinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and Tags
- Kovah LinkAce
- Information disclosure
- Broken access control
- CVSS 7.1 High
LinkAce: Data Exfiltration via Export Functions Allow Access to All Users' Private Links
- Kovah LinkAce
- Information disclosure
- Broken access control
- CVSS 2.3 Low
LinkAce: Limited Server-Side Request Forgery (SSRF) in Keyword Fetching Functionality
- Kovah LinkAce
- Server-side request forgery (SSRF)
- CVSS 7.3 High
LinkAce Vulnerable to Stored XSS on the Audit Page
- Kovah LinkAce
- Cross-site scripting (XSS)
- CVSS 8.4 High
LinkAce has a Stored One Click XSS vulnerability
- Kovah LinkAce
- Cross-site scripting (XSS)
- CVSS 7.6 High
File Upload Vulnerability Leading to XSS in LinkAce v1.15.5
- Kovah LinkAce
- Unrestricted file upload
- CVSS 4.6 Medium
Reflected Cross-Site Scripting (XSS) Vulnerability in LinkAce
- Kovah LinkAce
- Cross-site scripting (XSS)