Advisories · Technology
lukevella rallly.
Every CVE that names lukevella rallly among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
Rallly before 4.15.0 Information Disclosure via polls.get
- lukevella rallly
- Information disclosure
- CVSS 5.1 Medium
lukevella rallly Reset Password reset-password-form.tsx cross site scripting
- lukevella rallly
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.1 High
Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings
- lukevella rallly
- Information disclosure
- Broken access control
- CVSS 8.1 High
Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId
- lukevella rallly
- Broken access control
- CVSS 8.1 High
Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation
- lukevella rallly
- Broken access control
- CVSS 6.5 Medium
Rallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names
- lukevella rallly
- Broken access control
- CVSS 6.5 Medium
Rallly Improper Authorization in Comment Endpoint Allows User Impersonation
- lukevella rallly
- Broken access control
- CVSS 7.1 High
Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal
- lukevella rallly
- Broken access control
- CVSS 8.1 High
Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants
- lukevella rallly
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR)
- lukevella rallly
- Broken access control
- CVSS 6.5 Medium
Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)
- lukevella rallly
- Broken access control
- CVSS 6.5 Medium
Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes
- lukevella rallly
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Rallly Insufficient Password Login Token Entropy Leads to Account Takeover
- lukevella rallly
- CWE-331