216 matches found
Stored XSS in link tags added via XHR in SilverStripe Framework
SilverStripe Framework 4.x prior to 4.10.9 is vulnerable to cross-site scripting inside the href attribute of an HTML hyperlink, which can be added to website content via XMLHttpRequest XHR by an authenticated CMS user...
CVE-2022-28803
In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest XHR...
CVE-2022-28803
In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest XHR...
Cross site scripting
In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest XHR...
CVE-2022-28803
In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest XHR...
PT-2022-19248 · Silverstripe · Silverstripe/Framework
Name of the Vulnerable Software and Affected Versions: SilverStripe Framework versions prior to 4.10.9 SilverStripe Framework through 2022-04-07 Description: The issue allows for Stored XSS to occur in javascript link tags added via XMLHttpRequest XHR. This can happen when an authenticated CMS us...
CVE-2022-24444
Silverstripe silverstripe/framework through 4.10 allows Session Fixation...
CVE-2022-25238
Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...
Session fixation
Silverstripe silverstripe/framework through 4.10 allows Session Fixation...
CVE-2022-24444
Silverstripe silverstripe/framework through 4.10 allows Session Fixation...
CVE-2021-41559
Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array that enables a remote attack via a crafted XML document...
PT-2022-11429 · Silverstripe · Silverstripe/Framework
Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.8.1 through 4.10.9 Description: The issue is related to a quadratic blowup in the Convert::xml2array function, which can be exploited via a crafted XML document to enable a remote attack...
silverstripe framework 授权问题漏洞
silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 4.10 and earlier versions, which stems from the fact that the Silverstripe ID does not expire upon logout...
silverstripe framework 资源管理错误漏洞
silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 4.8.1. An attacker can exploit this vulnerability to conduct remote attacks via specially crafted XML documents...
silverstripe framework 授权问题漏洞
silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 1.10 and earlier versions. An attacker can exploit this vulnerability to conduct cross-site scripting attacks...
silverstripe framework 跨站脚本漏洞
silverstripe framework is a set of CMS website frameworks. A security vulnerability exists in silverstripe framework version 2022-04-07 and earlier versions. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via the XMLHttpRequest XHR javascript link tag...
GHSA-GM5X-HPMW-XPXG Silverstripe CMS information disclosure
In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to...
Business Logic Errors in SilverStripe Framework
SilverStripe Framework prior to version 4.10.1 is vulnerable to business logic errors...