Directus 代码问题漏洞

Directus is a real-time Api and application dashboard. It is used to manage Sql database content. A code issue vulnerability exists in Directus versions v9.0.0-beta.2 through 9.6.0, which stems from a server-side request forgery SSRF vulnerability in the media upload feature. An attacker could us...

Insecure Defaults

directus is using insecure defaults. The use of default CORS settings in the Record function of env.ts which are very permissive for uncontrolled environments allows an attacker to access unauthorized resources in the system...

Directus Cross-Site Scripting Vulnerability (CNVD-2022-81371)

Directus is a live Api and application dashboard. Used to manage Sql database content, a cross-site scripting vulnerability existed prior to Directus version 9.7.0, which stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this...

dbaas (>=0.1.6, <=0.5.1) potentially affected by CVE-2022-26969 via directus (9.6.0)

directus NPM version 9.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on directus and may be impacted: - dbaas =0.1.6, =0.5.1 Source cves: CVE-2022-26969 Source advisory: OSV:GHSA-G27J-74FP-XFPR...

GHSA-G27J-74FP-XFPR Insecure default value for CORS configuration

Impact The default value for the CORSENABLED and CORSORIGIN configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed. Patches The default values for CORS have been changed in...

Insecure default value for CORS configuration

Impact The default value for the CORSENABLED and CORSORIGIN configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed. Patches The default values for CORS have been changed in...

dbaas (>=0.1.6, <=0.5.1) potentially affected by CVE-2022-24814 via directus (9.6.0)

directus NPM version 9.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on directus and may be impacted: - dbaas =0.1.6, =0.5.1 Source cves: CVE-2022-24814 Source advisory: OSV:GHSA-XMJJ-3C76-5W84...

GHSA-XMJJ-3C76-5W84 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus

Impact Unauthorized JavaScript can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run an...

Cross-Site Scripting (XSS)

directus is vulnerable to cross-site scripting. The vulnerability exists because the live embed in the WYSIWYG is not disabled which allows an attacker to inject and execute arbitrary javascript...

PT-2022-18147 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions prior to 9.7.0 Description: The default settings of CORS ORIGIN and CORS ENABLED in Directus are true, which could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed. This is...

CVE-2022-24814

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript JS can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script ta...

Design/Logic Flaw

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript JS can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script ta...

CVE-2022-24814

Directus XSS in Rich Text HTML interface: prior to v9.7.0, an iframe that links to an uploaded HTML file can load a second uploaded JS file, bypassing CSP and allowing arbitrary JS execution. Root cause: unsafe handling of embedded JS via WYSIWYG content. Impact: unauthorized JS execution within ...

CVE-2022-24814 Cross-site Scripting in Directus

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript JS can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script ta...

CVE-2022-24814 Cross-site Scripting in Directus

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript JS can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script ta...

CVE-2022-24814 Cross-site Scripting in Directus

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript JS can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script ta...

Directus 跨站脚本漏洞

Directus is a live Api and application dashboard. Used to manage Sql database content, a cross-site scripting vulnerability existed prior to Directus version 9.7.0, which stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this...

CVE-2022-24814: Improper Neutralization of Input During Web Page Generation

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript JS can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script ta...

Directus Cross-Site Scripting Vulnerability (CNVD-2022-08389)

Directus is a real-time Api and application dashboard. Used to manage Sql database content. Directus suffers from a cross-site scripting vulnerability that allows unlimited uploading of .html files in the media upload function, which leads to a cross-site scripting vulnerability. A low-privileged...

Directus Cross-Site Scripting Vulnerability

Directus is a real-time Api and application dashboard. Used to manage Sql database content. A cross-site scripting vulnerability exists in Directus that allows unlimited uploads of .html files in the media upload feature and can be exploited by a low-privileged attacker to execute JavaScript code...