CVE-2017-15203

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Oct 11, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-152044.3In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user.CVE-2017-152054.3In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user.CVE-2017-152064.3In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user.CVE-2017-152074.3In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user.CVE-2017-152084.3In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user.CVE-2017-152094.3In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user.CVE-2017-15216.1IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications (IBM BigFix Platform 9.2 and 9.5) is vulnerable to cross-sCVE-2017-152104.3In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another useCVE-2017-152114.3In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user.CVE-2017-152124.3In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another uCVE-2017-152135.4Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via CVE-2017-152145.4Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileg