tgstation13 tgstation-server

tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users

In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allowing subsequent logins to succeed with any username or password.

tgstation-server's role authorization incorrectly OR'd with user's enabled status

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine (accessible by the owner of the server process) via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files, however.

Insufficiently Protected ChatBot Credentials in tgstation-server

Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API

Windows user name disclosure in TGstation