Malicious Package

Overview strapi-plugin-workspace-plugin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

EUVD-2023-2899

Malicious code in bioql PyPI...

Denial-of-Service (DoS)

@strapi/plugin-upload is vulnerable to Denial-of-Service DoS. The vulnerability is due to the server crashing without restarting when handling errors, causing it to become unavailable for all clients until manually restarted...

@code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.4.3), @cowprotocol/cms (0.1.0-rc.5) +17 more potentially affected by CVE-2024-34065 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =0.0.1, =0.1.0, =0.1.10 and more Source cves: CVE-2024-34065 Source advisory: GHSA-WRVH-RCMR-9QFC...

@code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.4.3), @cowprotocol/cms (0.1.0-rc.5) +17 more potentially affected by CVE-2024-34065 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =0.0.1, =0.1.0, =0.1.10 and more Source cves: CVE-2024-34065 Source advisory: OSV:GHSA-WRVH-RCMR-9QFC...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +84 more potentially affected by CVE-2024-31217 via @strapi/plugin-upload (>=4.0.0-beta.0, <=4.21.1)

@strapi/plugin-upload NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-31217 Source advisory: GHSA-PM9Q-XJ9P-96PM...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +84 more potentially affected by CVE-2024-31217 via @strapi/plugin-upload (>=4.0.0-beta.0, <=4.21.1)

@strapi/plugin-upload NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-31217 Source advisory: OSV:GHSA-PM9Q-XJ9P-96PM...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +80 more potentially affected by CVE-2024-29181 via @strapi/plugin-content-manager (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-content-manager NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-29181 Source advisory: GHSA-6J89-FRXC-Q26M...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +80 more potentially affected by CVE-2024-29181 via @strapi/plugin-content-manager (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-content-manager NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-29181 Source advisory: OSV:GHSA-6J89-FRXC-Q26M...

@code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.4.3), @cowprotocol/cms (0.1.0-rc.5) +17 more potentially affected by CVE-2024-34065 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =0.0.1, =0.1.0, =0.1.10 and more Source cves: CVE-2024-34065 Source advisory: MEND:CVE-2024-34065...

CVE-2024-34065

Strapi is an open-source content management system. By combining two vulnerabilities an "Open Redirect" and "session token sent as URL query parameter" in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +84 more potentially affected by CVE-2024-31217 via @strapi/plugin-upload (>=0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, <=4.21.1)

@strapi/plugin-upload NPM version =0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-31217 Source advisory: MEND:CVE-2024-31217...

CVE-2024-31217

Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause ...

CVE-2024-31217

CVE-2024-31217 is a DoS in Strapi’s media upload via @strapi/plugin-upload prior to version 4.22.0. The vulnerability can crash the server during file uploads without restart, affecting both development and production environments. The issue arises when errors are mishandled, causing the server t...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +80 more potentially affected by CVE-2024-29181 via @strapi/plugin-content-manager (>=0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, <=4.19.0)

@strapi/plugin-content-manager NPM version =0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-29181 Source advisory: MEND:CVE-2024-29181...

CVE-2024-29181

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...

CVE-2024-31217: Uncaught Exception

Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause ...

CVE-2024-29181: Authorization Bypass Through User-Controlled Key

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...

CVE-2024-34065: Authentication Bypass by Capture-replay

Strapi is an open-source content management system. By combining two vulnerabilities an Open Redirect and session token sent as URL query parameter in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and...

PT-2024-25676 · Strapi · @Strapi/Plugin-Users-Permissions

Name of the Vulnerable Software and Affected Versions: @strapi/plugin-users-permissions versions prior to 4.24.2 Description: The issue arises from combining two vulnerabilities in @strapi/plugin-users-permissions: an Open Redirect and a session token sent as a URL query parameter. This allows an...