Cross site scripting

In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest XHR...

CVE-2022-28803

In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest XHR...

PT-2022-19248 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: SilverStripe Framework versions prior to 4.10.9 SilverStripe Framework through 2022-04-07 Description: The issue allows for Stored XSS to occur in javascript link tags added via XMLHttpRequest XHR. This can happen when an authenticated CMS us...

CVE-2022-24444

Silverstripe silverstripe/framework through 4.10 allows Session Fixation...

CVE-2022-25238

Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

Session fixation

Silverstripe silverstripe/framework through 4.10 allows Session Fixation...

CVE-2022-24444

Silverstripe silverstripe/framework through 4.10 allows Session Fixation...

CVE-2021-41559

Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array that enables a remote attack via a crafted XML document...

PT-2022-11429 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.8.1 through 4.10.9 Description: The issue is related to a quadratic blowup in the Convert::xml2array function, which can be exploited via a crafted XML document to enable a remote attack...

silverstripe framework 跨站脚本漏洞

silverstripe framework is a set of CMS website frameworks. A security vulnerability exists in silverstripe framework version 2022-04-07 and earlier versions. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via the XMLHttpRequest XHR javascript link tag...

silverstripe framework 授权问题漏洞

silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 1.10 and earlier versions. An attacker can exploit this vulnerability to conduct cross-site scripting attacks...

silverstripe framework 资源管理错误漏洞

silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 4.8.1. An attacker can exploit this vulnerability to conduct remote attacks via specially crafted XML documents...

silverstripe framework 授权问题漏洞

silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 4.10 and earlier versions, which stems from the fact that the Silverstripe ID does not expire upon logout...

GHSA-GM5X-HPMW-XPXG Silverstripe CMS information disclosure

In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to...

Business Logic Errors in SilverStripe Framework

SilverStripe Framework prior to version 4.10.1 is vulnerable to business logic errors...

GHSA-J66H-CC96-C32Q Cross-site Scripting in SilverStripe Framework

SilverStripe Framework through 4.8.1 allows XSS...

CVE-2021-36150

SilverStripe Framework through 4.8.1 allows XSS...

CVE-2021-36150

CVE-2021-36150 affects the SilverStripe Framework up to version 4.8.1, which allows Cross-Site Scripting (XSS). The root cause described across connected sources is insufficient validation of input/data, enabling script execution in the context of vulnerable applications. Impact is limited to bro...

PT-2021-21140 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: SilverStripe Framework versions prior to 4.8.2 Description: The issue allows for XSS. Recommendations: For versions prior to 4.8.2, update to version 4.8.2 or later to resolve the issue...

XML External Entitty (XXE)

silverstripe/framework is vulnerable to XML external entity XXE attacks. The loading of external entities and DTDs are not disabled and allows an attacker to perform server-side request forgery SSRF attacks or retrieve confidential system files via a malicious XML document...