Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
884 results · page 14 of 18
Jul 25, 2023Strapi is an open-source headless content management system.CVE-2023-34093 · Other software · strapi · reported by GitHubMedium 4.8
Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types themselves. Users can use plugins or modify their own content types without realizing that the `privateAttributes` getter is being removed, which can result in any attribute becoming public. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker(having access to password hashes). Anyone can be impacted, depending on how people are using/extending content-types. If the users are mutating the content-type, they will not be affected. Version 4.10.8 contains a patch for this issue.
- Product
- strapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2023Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.CVE-2023-37269 · Other software · wintercms · reported by GitHubLow 2
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting (XSS) attack. To exploit the vulnerability, an attacker would already need to have developer or super user level permissions in Winter CMS. This means they would already have extensive access and control within the system. Additionally, to execute the XSS, the attacker would need to convince the victim to directly visit the URL of the maliciously uploaded SVG, and the application would have to be using local storage where uploaded files are served under the same domain as the application itself instead of a CDN. This is because all SVGs in Winter CMS are rendered through an `img` tag, which prevents any payloads from being executed directly. These two factors significantly limit the potential harm of this vulnerability. This issue has been patched in v1.2.3 through the inclusion of full support for SVG uploads and automatic sanitization of uploaded SVG files. As a workaround, one may a
- Product
- winter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 5, 2023Statamic is a flat-first, Laravel and Git powered content management system.CVE-2023-36828 · Other software · statamic · reported by GitHubMedium 5.5
Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF).CVE-2023-36814 · Other software · zopefoundation · reported by GitHubHigh 7.5
Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on `PortalFolder` objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable. The code has been fixed in `Products.CMFCore` version 3.2.
- Product
- Products.CMFCore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Grav is a flat-file content management system.CVE-2023-34452 · Other software · getgrav · reported by GitHubMedium 5.4
Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the "email" parameter of the request. While this vulnerability can potentially allow an attacker to execute arbitrary code on the user's browser, the impact is limited as it requires user interaction to trigger the vulnerability. As of time of publication, a patch is not available. Server-side validation should be implemented to prevent this vulnerability.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Grav is a flat-file content management system.CVE-2023-34448 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2 overrides the built-in Twig `map()` and `reduce()` filter functions in `system/src/Grav/Common/Twig/Extension/GravExtension.php` to validate the argument passed to the filter in `$arrow`.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Grav is a flat-file content management system.CVE-2023-34253 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. A patch in version 1.7.42 improves the denylist.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Grav is a flat-file content management system.CVE-2023-34252 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipped. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. The vulnerability can be found in the `GravExtension.filterFilter()` function declared in `/system/src/Grav/Common/Twig/Extension/GravExtension.php`. Version 1.7.42 contains a patch for this issue. End users should also ensure that `twig.undefined_functions` and `twig.undefined_filters` properties in `/path/to/webroot/system/config/system.yaml` configuration file are set to `false` to disallow Twig from treating undefined filters/functions as PHP functions and executing them.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Grav is a flat-file content management system.CVE-2023-34251 · Other software · getgrav · reported by GitHubCritical 9.9
Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023Keystone is a content management system for Node.JS.CVE-2023-34247 · Other software · keystonejs · reported by GitHubMedium 6.1
Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect leading `/` filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the `@keystone-6/auth` package.
- Product
- keystone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Xibo is a content management system (CMS).CVE-2023-33181 · Other software · xibosignage · reported by GitHubMedium 4.3
Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Xibo is a content management system (CMS).CVE-2023-33180 · Other software · xibosignage · reported by GitHubMedium 6.5
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the `/display/map` API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `bounds` parameter. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Xibo is a content management system (CMS).CVE-2023-33179 · Other software · xibosignage · reported by GitHubMedium 6.5
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.5 in the `nameFilter` function used throughout the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values for logical operators. Users should upgrade to version 3.3.5 which fixes this issue. There are no known workarounds aside from upgrading.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Xibo is a content management system (CMS).CVE-2023-33178 · Other software · xibosignage · reported by GitHubMedium 6.5
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `/dataset/data/{id}` API route inside the CMS starting in version 1.4.0 and prior to versions 2.3.17 and 3.3.5. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `filter` parameter. Values allowed in the filter parameter are checked against a deny list of commands that should not be allowed, however this checking was done in a case sensitive manor and so it is possible to bypass these checks by using unusual case combinations. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. There are no workarounds aside from upgrading.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Xibo is a content management system (CMS).CVE-2023-33177 · Other software · xibosignage · reported by GitHubHigh 8.8
Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outside of the CMS library directory as the webserver user. This can be used to upload a PHP webshell inside the web root directory and achieve remote code execution as the webserver user. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. Customers who host their CMS with Xibo Signage have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023IT Sourcecode Content Management System Project In PHP and MySQL With Source Code 1.0.0 is vulnerable to Cross Site Scripting (XSS) via /ecodesource/search_listCVE-2023-31816 · Other software · Content Management System Project · reported by MITREMedium 6.1
IT Sourcecode Content Management System Project In PHP and MySQL With Source Code 1.0.0 is vulnerable to Cross Site Scripting (XSS) via /ecodesource/search_list.php.
- Product
- Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2023Craft CMS is an open source content management system.CVE-2023-32679 · Other software · craftcms · reported by GitHubHigh 7.2
Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote Code Execution. If the name parameter value is not empty string('') in the View.php's doesTemplateExist() -> resolveTemplate() -> _resolveTemplateInternal() -> _resolveTemplate() function, it returns directly without extension verification, so that arbitrary extension files are rendered as twig templates. When attacker with admin privileges on a DEV or an improperly configured STG or PROD environment, they can exploit this vulnerability to remote code execution. Code execution may grant the attacker access to the host operating system. This issue has been addressed in version 4.4.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Craft CMS is a content management system.CVE-2023-31144 · Other software · craftcms · reported by GitHubMedium 6.1
Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Payload is a free and open source headless content management system.CVE-2023-30843 · Other software · payloadcms · reported by GitHubHigh 7.4
Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system.CVE-2023-22729 · Other software · silverstripe · reported by GitHubMedium 5.4
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can display a link to a third party website on a login screen by convincing a legitimate content author to follow a specially crafted link. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.
- Product
- silverstripe-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system.CVE-2023-22728 · Other software · silverstripe · reported by GitHubMedium 4.3
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.
- Product
- silverstripe-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023Contao is an open source content management system.CVE-2023-29200 · Other software · contao · reported by GitHubMedium 4.3
Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2023Wagtail is an open source content management system built on Django.CVE-2023-28837 · Other software · wagtail · reported by GitHubMedium 4.9
Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A user with access to upload images or documents through the Wagtail admin interface could upload a file so large that it results in a crash of denial of service. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. It can only be exploited by admin users with permission to upload images or documents. Image uploads are restricted to 10MB by default, however this validation only happens on the frontend and on the backend after the vulnerable code. Patched versions have been released as Wagtail 4.1.4 and Wagtail 4.2.2). Site owners who are unable to upgrade to the new versions are encouraged to add extra protections outside of Wagtail to limit the size of uploaded files.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.wagtail.orggithub.com
Apr 3, 2023Wagtail is an open source content management system built on Django.CVE-2023-28836 · Other software · wagtail · reported by GitHubMedium 6.4
Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a stored cross-site scripting (XSS) vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft pages and documents that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites with ModelAdmin enabled. For page, the vulnerability is in the "Choose a parent page" ModelAdmin view (`ChooseParentView`), available when managing pages via ModelAdmin. For documents, the vulnerability is in the ModelAdmin Inspect view (`InspectView`) when displaying document fields. Patched versions have been released as Wagtail 4.1.4 and Wagtail 4.2.2. Site owners who are unable to upgrade to the new versions can disable or override the corresponding functionality.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.wagtail.orgdocs.wagtail.org
Mar 23, 2023baserCMS is a Content Management system.CVE-2023-25655 · Other software · baserproject · reported by GitHubCritical 9.8
baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023baserCMS is a Content Management system.CVE-2023-25654 · Other software · baserproject · reported by GitHubCritical 9.8
baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Cockpit is a content management system that allows addition of content management functionality to any site.CVE-2021-32857 · Other software · microweber · reported by GitHubMedium 6.1
Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue.
- Product
- microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Microweber is a drag and drop website builder and content management system.CVE-2021-32856 · Other software · microweber · reported by GitHubMedium 6.1
Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted in versions 1.2.9 and 1.2.12, but it is incomplete.
- Product
- microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Feb 8, 2023Tinacms is a Git-backed headless content management system with support for visual editing.CVE-2023-25164 · Other software · tinacms · reported by GitHubHigh 8.6
Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If you are affected and your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. This issue has been patched in @tinacms/cli@1.0.9. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2023TYPO3 is a free and open source Content Management Framework released under the GNU General Public License.CVE-2023-24814 · Other software · TYPO3 · reported by GitHubHigh 8.8
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered server environment variable `PATH_INFO`, which allows attackers to inject malicious content. In combination with the TypoScript setting `config.absRefPrefix=auto`, attackers can inject malicious HTML code to pages that have not been rendered and cached, yet. As a result, injected values would be cached and delivered to other website visitors (persisted cross-site scripting). Individual code which relies on the resolved value of `GeneralUtility::getIndpEnv('SCRIPT_NAME')` and corresponding usages (as shown below) are vulnerable as well. Additional investigations confirmed that at least Apache web server deployments using CGI (FPM, FCGI/FastCGI, and similar) are affected. However, there still might be the risk that other scenarios like nginx, IIS, or Apache/mod_php are vulnerable. The usage of server environment variable `PATH_INFO` has been removed from corresponding processings in `GeneralUtility::getIndpEnv()`. Besides that, the public property `TypoScriptFrontendController::$abs
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.typo3.orggithub.com
Jan 19, 2023Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php.CVE-2022-47740 · Other software · Seltmann-webdesign · reported by MITRECritical 9.8
Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php.
- Product
- Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023The Nuxeo Platform is an open source content management platform for building business applications.CVE-2021-32828 · Other software · Hyland · reported by GitHubMedium 5.4
The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the `oauth2` REST API is vulnerable to Reflected Cross-Site Scripting (XSS). This XSS can be escalated to Remote Code Execution (RCE) by levering the automation API.
- Product
- Nuxeo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Dec 14, 2022TYPO3 is an open source PHP based web content management system.CVE-2022-23504 · Other software · TYPO3 · reported by GitHubMedium 5.7
TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022TYPO3 is an open source PHP based web content management system.CVE-2022-23503 · Other software · TYPO3 · reported by GitHubHigh 7.5
TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible to inject code instructions to be processed and executed via TypoScript as PHP code. The existence of individual TypoScript instructions for a particular form item and a valid backend user account with access to the form module are needed to exploit this vulnerability. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022TYPO3 is an open source PHP based web content management system.CVE-2022-23502 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. This issue is patched in versions 10.4.33, 11.5.20, 12.1.1.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022TYPO3 is an open source PHP based web content management system.CVE-2022-23501 · Other software · TYPO3 · reported by GitHubMedium 5.9
TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022TYPO3 is an open source PHP based web content management system.CVE-2022-23500 · Other software · TYPO3 · reported by GitHubMedium 5.9
TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022BaserCMS is a content management system with a japanese language focus.CVE-2022-39325 · Other software · baserproject · reported by GitHubMedium 4.6
BaserCMS is a content management system with a japanese language focus. In affected versions there is a cross-site scripting vulnerability on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. Users of baserCMS are advised to upgrade as soon as possible. There are no known workarounds for this vulnerability.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Oct 26, 2022Winter is a free, open-source content management system based on the Laravel PHP framework.CVE-2022-39357 · Other software · wintercms · reported by GitHubHigh 8.1
Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by following some common security practices for JavaScript, including implementing a content security policy and auditing scripts.
- Product
- winter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022@keystone-6/core is a core package for Keystone 6, a content management system for Node.js.CVE-2022-39322 · Other software · keystonejs · reported by GitHubCritical 9.1
@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their `multiselect` fields to use the field-level access control - if configured - are vulnerable to their field-level access control not being used. List-level access control is not affected. Field-level access control for fields other than `multiselect` are not affected. Version 2.3.1 contains a fix for this issue. As a workaround, stop using the `multiselect` field.
- Product
- keystone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022Kirby is a Content Management System.CVE-2022-39315 · Other software · getkirby · reported by GitHubMedium 6.5
Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be exploited for targeted attacks because the attack does not scale to brute force. The problem has been patched in Kirby 3.5.8.2, Kirby 3.6.6.2, Kirby 3.7.5.1, and Kirby 3.8.1. In all of the mentioned releases, the maintainers have rewritten the affected code so that the delay is also inserted after the brute force limit is reached.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework.CVE-2022-35944 · Other software · octobercms · reported by GitHubMedium 6.2
October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (`cms.safe_mode`) restriction to introduce new PHP code in a CMS template using a specially crafted request. The issue has been patched in versions 2.2.34 and 3.0.66.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2022Orckestra C1 CMS is a .NET based Web Content Management System.CVE-2022-39256 · Other software · Orckestra · reported by GitHubCritical 9
Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.
- Product
- C1-CMS-Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2022-36108 · Other software · TYPO3 · reported by GitHubMedium 6.5
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2022-36107 · Other software · TYPO3 · reported by GitHubMedium 6.5
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2022-36106 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2022-36105 · Other software · TYPO3 · reported by GitHubMedium 5.3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new `MimicServiceInterface::mimicAuthUser`, which simulates corresponding times regular processing would usually take. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix this problem. There are no known workarounds for this issue.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2022-36104 · Other software · TYPO3 · reported by GitHubMedium 5.9
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface.CVE-2022-36037 · Other software · getkirby · reported by GitHubMedium 5.9
kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting (XSS) is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. If bad actors gain access to your group of authenticated Panel users they can escalate their privileges via the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. The multiselect field allows selection of tags from an autocompleted list. Unfortunately, the Panel in Kirby 3.5 used HTML rendering for the raw option value. This allowed **attackers with influence on the options source** to store HTML code. The browser of the victim who visited a page with manipulated multiselect options in the Panel will then have rendered this malicious HTML code when the victim opened the autocomplete dropdown. Users are *not* affected by this vulnerability if you don't use the multiselect field or don't use it with options that can be manipulated by att
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022Directus is a free and open-source data platform for headless content management.CVE-2022-36031 · Other software · directus · reported by GitHubMedium 6.5
Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the `filename_disk` value to a folder and accessing that file through the `/assets` endpoint. This vulnerability has been patched and release v9.15.0 contains the fix. Users are advised to upgrade. Users unable to upgrade may prevent this problem by making sure no (untrusted) non-admin users have permissions to update the `filename_disk` field on `directus_files`.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.