Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

npm

@actual-app/sync-server

npm

actual syncing server

View on github.com · View on npmjs.org

Security Advisories for @actual-app/sync-server in npm

High
19 days ago

@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens GSA_kwCzR0hTQS1jcTljLTZ3NDgtcW1mZ84ABZRi

npm @actual-app/sync-server
Moderate
19 days ago

@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets GSA_kwCzR0hTQS0zZjYyLXF2OTYtNHA3OM4ABZRW

npm @actual-app/sync-server
High
3 months ago

Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers GSA_kwCzR0hTQS1wcnA0LTJmNDktZmNncM4ABVsa

npm @actual-app/sync-server
Moderate
4 months ago

Actual Sync Server has an Authenticated Path Traversal GSA_kwCzR0hTQS0yN3ZnLTMzZ2gtNGh3Z84ABTXI

npm @actual-app/sync-server
Moderate
4 months ago

@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode GSA_kwCzR0hTQS1xbWpqLXA3bTktd2pyds4ABS6k

npm @actual-app/sync-server
Critical
5 months ago

ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints GSA_kwCzR0hTQS1tMmNxLXhqZ20tZjY2OM4ABSy2

npm @actual-app/sync-server
Moderate
9 months ago

Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers GSA_kwCzR0hTQS14dnA3LTh2bTgteGZ4eM4ABNjO

npm @actual-app/sync-server

Filter by Severity

Moderate 4 High 2 Critical 1