192 matches found
CVE-2021-29484
Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and m...
CVE-2021-29484
Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and m...
Code injection
Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and m...
CVE-2021-29484
Ghost CMS vulnerable影 DOM-based XSS (CVE-2021-29484) affecting Ghost 4.0.0 to 4.3.2 via an unused /ghost/preview endpoint. The admin frontend’s theme preview listens for postMessage without origin validation, allowing a logged-in admin to be compromised when visiting a malicious site. A fix was a...
Ghost CMS 跨站脚本漏洞
Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. Ghost CMS suffers from a cross-site scripting vulnerability that can be exploited by an attacker to gain access by having a logged-in user click on a link containing...
Ghost CMS Server-Side Request Forgery Vulnerability
Ghost CMS is an open source headless content management system CMS written in JavaScript. A server-side request forgery vulnerability exists in Ghost CMS versions prior to 3.10.0, which can be exploited by an attacker to scan local or external networks or interact with internal systems...
CVE-2020-8134
Server-side request forgery SSRF vulnerability in Ghost CMS 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems...
CVE-2020-8134
Server-side request forgery SSRF vulnerability in Ghost CMS 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems...
Server side request forgery (ssrf)
Server-side request forgery SSRF vulnerability in Ghost CMS 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems...
CVE-2020-8134
CVE-2020-8134 corresponds to a Ghost CMS SSRF flaw in the code path prior to version 3.10.0. The issue allows an attacker to scan internal or external networks or interact with internal systems through server-side requests. This affects Ghost CMS deployments running versions earlier than 3.10.0; ...
