1247 matches found
CVE-2019-13983
Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...
CVE-2019-13983
Directus 7 API before 2.2.2 is affected by insufficient anti-automation due to lack of CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php. This creates a risk of automated login attempts (brute force). The evidence across multiple sources confirms the vulnerability in Direct...
CVE-2019-13984
Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File...
CVE-2019-13984
Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File...
CVE-2019-13984
Directus 7 API before 2.3.0 fails to validate uploaded files; regardless of extension or MIME type there is a direct link to each uploaded file, accessible by unauthenticated users. Root cause: missing file validation in the upload flow, enabling access to uploaded content (as demonstrated by the...
PT-2019-13508
Name of the Vulnerable Software and Affected Versions Directus versions prior to 2.2.1 Description The issue allows for remote code execution due to the uploading of PHP files not being blocked. This can lead to uploads/ /originals remote code execution. Recommendations For versions prior to 2.2....
PT-2019-13510
Name of the Vulnerable Software and Affected Versions Directus versions 7 through 2.3.0 Description The issue allows remote attackers to read image files by making a direct request for a filename under the uploads/ /originals/ directory. This is related to a configuration option where the file...
PT-2019-13512
Name of the Vulnerable Software and Affected Versions Directus versions prior to 2.2.2 Description The issue is related to insufficient anti-automation measures. Specifically, it is demonstrated by the lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php, which are A...
CVE-2019-13981: Direct Request
In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads//originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer...
PT-2019-13511
Name of the Vulnerable Software and Affected Versions Directus versions prior to 7.7.0 Description The issue concerns the rendering of Markdown text previews in the Directus 7 Application. Specifically, it does not properly sanitize Markdown text before rendering a preview, which could lead to...
CVE-2019-13983: Missing Authentication for Critical Function
Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...
CVE-2019-13982: Undefined Security Weakness
interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview...
CVE-2019-13984: Unrestricted Upload of File with Dangerous Type
Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File...
PT-2019-13513
Name of the Vulnerable Software and Affected Versions Directus 7 versions prior to 2.3.0 Description The issue concerns the lack of validation for uploaded files, allowing unauthenticated users to access them directly, regardless of the file extension or MIME type. This is demonstrated by the...
CVE-2019-13979: Unrestricted Upload of File with Dangerous Type
In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads//originals remote code execution...
CVE-2019-13980: Unrestricted Upload of File with Dangerous Type
In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads//originals remote code execution with nginx...
PT-2019-13509
Name of the Vulnerable Software and Affected Versions Directus versions 7 through 2.3.0 Description The issue allows for remote code execution through uploads of PHP files when using nginx, as the upload blocking only works with Apache HTTP Server. Recommendations For Directus versions 7 through...
Directus Suite CMS 7.0.15 Database Disclosure
Exploit Title : Directus Suite CMS 7.0.15 Database Disclosure Exploit Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 02/04/2019 Vendor Homepage : directus.io Software Download Link : github.com/directus/directus/archive/master.zip Software Information Link :...
Directus Elevation of Privilege Vulnerability
Directus is a content management system CMS. A security vulnerability exists in Directus version 6.4.9 that stems from the use of a hard-coded password: admin for the Admin account, which can be exploited by an attacker to elevate privileges...
