This repository provides public security resources of StrangeBee, like security notes & advisories, policies and more.
- SB-SEC-ADV-2022-001: Authentication bypass due to incomplete checks in the Active Directory authentication module
- SB-SEC-ADV-2022-002: Unauthentified API endpoint leaking data
- SB-SEC-ADV-2023-001: Reporting – Stored Cross-Site Scripting
- SB-SEC-ADV-2023-002: Attachment – Stored Cross-Site Scripting
- SB-SEC-ADV-2023-003: Branding Logo – Reflected Cross-Site Scripting
- SB-SEC-ADV-2023-004: MFA - Lack of Lockout Policy
- SB-SEC-ADV-2023-005: Username Enumeration
- SB-SEC-ADV-2024-001: Username Enumeration
- SB-SEC-ADV-2025-001: Cross-Site Request Forgery
- SB-SEC-ADV-2025-002: Server-Side Request Forgery
- SB-SEC-ADV-2025-003: Email Bombing Through Password Reset API Feature
- SB-SEC-ADV-2025-004: Broken Access Control