990 matches found
Design/Logic Flaw
In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads//originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer...
Remote code execution
In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads//originals remote code execution with nginx...
Design/Logic Flaw
Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File...
Remote code execution
In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads//originals remote code execution...
CVE-2019-13979
Affected software: Directus 7 API (Directus 7) before version 2.2.1. Vulnerability details: The uploader does not block PHP file uploads, which can be stored under uploads/_/originals and lead to remote code execution. Root cause (as stated): failure to block PHP uploads. Impact: remote code exec...
CVE-2019-13979
In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads//originals remote code execution...
CVE-2019-13980
In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads//originals remote code execution with nginx...
CVE-2019-13980
Directus 7 API (up to version 2.3.0) permits PHP uploads only when using Apache; with nginx, uploads/_/originals can lead to remote code execution. No exploitation details are provided in the given documents beyond this risk description. Remediation/patch details are not included in the connected...
CVE-2019-13981
In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads//originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer...
CVE-2019-13981
The CVE affects Directus 7 API up to version 2.3.0. An information disclosure exists where remote attackers can read image files by directly requesting a filename under uploads/_/originals/. The vulnerability stems from a configuration option that can make the file collection non-public, but this...
CVE-2019-13982
interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview...
CVE-2019-13982
Directus 7 Application before 7.7.0 is affected by a vulnerability in interfaces/markdown/input.vue where Markdown text is not sanitized before rendering a preview. This is the only detail provided across sources; no explicit exploit, impact, affected versions beyond
CVE-2019-13983
Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...
CVE-2019-13983
Directus 7 API before 2.2.2 is affected by insufficient anti-automation due to lack of CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php. This creates a risk of automated login attempts (brute force). The evidence across multiple sources confirms the vulnerability in Direct...
CVE-2019-13984
Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File...
CVE-2019-13984
Directus 7 API before 2.3.0 fails to validate uploaded files; regardless of extension or MIME type there is a direct link to each uploaded file, accessible by unauthenticated users. Root cause: missing file validation in the upload flow, enabling access to uploaded content (as demonstrated by the...
CVE-2019-13983: Missing Authentication for Critical Function
Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...
CVE-2019-13984: Unrestricted Upload of File with Dangerous Type
Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File...
CVE-2019-13981: Direct Request
In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads//originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer...