Apostrophe licensing issue vulnerability

Apostrophe is a full-featured open source Cms built with Node.js by Apostrophe, Inc. designed to empower organizations by combining contextual editing and headless architecture in a full-stack Js environment.Apostrophe CMS is vulnerable to an authorization issue in versions 2.63.0 through 3.3.1,...

Apostrophe CMS Cross-Site Scripting Vulnerability

Apostrophe CMS is a fully functional open source CMS built using Node.js, designed to enhance organization by combining contextual editing and headless architecture in a full-stack JS environment.Apostrophe CMS = cross-site scripting vulnerability, which originates in Apostrophe CMS versions...

CVE-2021-25979

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...

CVE-2021-25979

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...

Session fixation

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...

CVE-2021-25979 Apostrophe - Insufficient Session Expiration

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...

CVE-2021-25979 Apostrophe - Insufficient Session Expiration

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...

@draadnl/openstad-cms (>=0.12.2, <=0.12.3), apostrophe-personas (>=2.0.0, <=2.2.1) +1 more potentially affected by CVE-2021-25979 via apostrophe (>=2.107.2, <=2.227.12)

apostrophe NPM version =2.107.2, =0.12.2, =2.0.0, =2.2.1 - apostrophe-selective-permissions 2.0.0 Source cves: CVE-2021-25979 Source advisory: MEND:CVE-2021-25979...

CVE-2021-25979

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...

CVE-2021-25979

Apostrophe CMS vulnerability CVE-2021-25979 affects versions 2.63.0 through 3.3.1, where the system does not invalidate existing login sessions when disabling a user or changing a password. This can allow a compromised device to maintain access after actions intended to lock out the user. The roo...

Apostrophe Code Issues and Vulnerabilities

Apostrophe is a full-featured open source Cms built with Node.js by Apostrophe, Inc. designed to empower organizations by combining contextual editing and headless architecture in a full-stack Js environment.Apostrophe CMS is vulnerable to an authorization issue in versions 2.63.0 through 3.3.1,...

PT-2021-16903 · Unknown · Apostrophe Cms

Name of the Vulnerable Software and Affected Versions: Apostrophe CMS versions prior to 3.3.1 Description: The issue allows unauthenticated remote attackers to hijack recently logged-in users' sessions due to insufficient session expiration. This can occur when a device is compromised by a third...

CVE-2021-25979: Insufficient Session Expiration

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...

CVE-2021-25978

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed...

CVE-2021-25978

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed...

Cross site scripting

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed...

CVE-2021-25978 Apostrophe - XSS

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed...

@draadnl/openstad-cms (>=0.12.2, <=0.12.3), apostrophe-personas (>=2.0.0, <=2.2.1) +1 more potentially affected by CVE-2021-25978 via apostrophe (>=2.107.2, <=2.227.12)

apostrophe NPM version =2.107.2, =0.12.2, =2.0.0, =2.2.1 - apostrophe-selective-permissions 2.0.0 Source cves: CVE-2021-25978 Source advisory: MEND:CVE-2021-25978...

CVE-2021-25978 Apostrophe - XSS

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed...

CVE-2021-25978

CVE-2021-25978 affects Apostrophe CMS versions 2.63.0–3.3.1. The flaw is a Stored XSS in the Images module: an editor-uploaded SVG containing malicious JavaScript can trigger XSS when viewed. The connected documents confirm the vulnerability class and affected range but do not provide a remediati...