Filtered by vendor Alf Subscriptions
Filtered by product Alf Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-2260 1 Alf 1 Alf 2024-11-21 8.8 High
Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
CVE-2023-2259 1 Alf 1 Alf 2024-11-21 7.2 High
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
CVE-2023-2258 1 Alf 1 Alf 2024-11-21 8.8 High
Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
CVE-2024-45299 1 Alf 1 Alf 2024-09-30 6.5 Medium
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The Content-Security-Policy directive blocks any potential script execution. The administrator or event administrator can override the texts for customization purpose. The texts are not properly escaped. Version 2.0-M5 fixes this issue.
CVE-2024-45300 1 Alf 1 Alf 2024-09-29 7.5 High
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.