Drawio <18.1.2 - Server-Side Request Forgery Detection

Drawio before 18.1.2 is susceptible to server-side request forgery via the /service endpoint in jgraph/drawio. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 --...

WS-2023-0211

Cross-site Scripting in Preview function bypass CSP in GitHub repository jgraph/drawio prior to 21.3.1...

WS-2022-0358

In jgraph/drawio prior to 20.4.2, it is possible to partially interrupt the proxy in the backend by redirecting to the same URL again. This may lead to Denial of Service in proxy by redirecting to own host. This vulnerability is capable of interrupting the proxy service for other users...

EUVD-2023-44598

Malicious code in bioql PyPI...

EUVD-2022-34320

Malicious code in bioql PyPI...

EUVD-2022-25008

Malicious code in bioql PyPI...

EUVD-2022-25048

Malicious code in bioql PyPI...

CVE-2023-3975

OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0...

CVE-2023-3973

Cross-site Scripting XSS - Reflected in GitHub repository jgraph/drawio prior to 21.6.3...

CVE-2023-3974

OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0...

CVE-2022-2015

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 19.0.2...

CVE-2022-1815

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2...

CVE-2022-3223

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 20.3.1...

CVE-2022-3127

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 20.2.8...

CVE-2022-3065

Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8...

CVE-2022-3133

OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0...

CVE-2022-1767

Server-Side Request Forgery SSRF in GitHub repository jgraph/drawio prior to 18.0.7...

CVE-2022-1774

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7...

CVE-2022-1713

SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information...

CVE-2022-1722

SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses...