Threats tagged 'ghsa-vqcv-983h-f3vr'

Vikunja versions prior to 2.7.1 have an insecure file permissions vulnerability where localStorage.Write creates blobs that are world-readable. This allows local users on a shared host to read sensitive stored data such as attachments, project backgrounds, exports, and to copy the SQLite database to attempt offline password hash cracking.