Skip to content
OpenAdvisories

Product · duck-organization

quest-bot

10 known vulnerabilities.

4 results · Clear filters · Feed

  • High 8.3

    Quest Bot: AutoMod removal can delete rules from another guild by global rule ID

    Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the AutoMod remove flow looks up and deletes rules by global database ID without verifying that the rule belongs to the guild where the command …

  • High 8.8

    Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`

    Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When the reminder triggers, the bot sends the stored message back…

  • High 7.2

    Quest Bot: Unprivileged users can create and remove AutoMod rules.

    Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.1, any guild member who can invoke slash commands can use /automod add, /automod remove, and /automod list because the command has no Discord defau…

  • High 7.5

    Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts

    Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a user with Manage Server / ManageGuild, but without Manage Roles or Administrator, can configure the bot’s AutoRole feature to assign an arbitr…