wger@2.1 vulnerabilities

FLOSS workout, fitness and weight manager/tracker written with Django

Known vulnerabilities in the wger package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
H Cross-site Request Forgery (CSRF) Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) such that it allows a remote attacker to gain privileges via the `user-management` feature in the `gym/views/gym.py`, `templates/gym/reset_user_password.html`, `templates/user/overview.html`, `core/views/user.py`, and `templates/user/preferences.html`, `core/forms.py` components. How to fix Cross-site Request Forgery (CSRF)? There is no fixed version for `wger`.	[0,)
M Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization. This issue allows a remote attacker to gain privileges via the `license_author` field in the `add-ingredient` function in the `templates/ingredients/view.html`, `models/ingredients.py`, and `views/ingredients.py` components. Note To exploit this vulnerability, the attacker would need to create an account. How to fix Cross-site Scripting (XSS)? There is no fixed version for `wger`.	[0,)
H Brute Force Affected versions of this package are vulnerable to Brute Force due to not limiting unsuccessful login attempts. How to fix Brute Force? A fix was pushed into the `master` branch but not yet published.	[0,)