CVE-2022-31367

Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses...

PT-2022-20719 · Strapi · Strapi

Name of the Vulnerable Software and Affected Versions: Strapi versions 3.x through 3.6.9 Strapi versions 4.x through 4.1.9 Description: The issue concerns the mishandling of hidden attributes within admin API responses. Recommendations: For Strapi versions 3.x through 3.6.9, update to version...

Strapi SQL注入漏洞

Strapi is an open source content management system CMS. versions of Strapi prior to 3.6.10 and 4.0.0 and later, and prior to 4.1.10, contain a SQL injection vulnerability that stems from its incorrect handling of hidden attributes in admin API responses. An attacker could exploit the vulnerabilit...

Authentication Bypass

strapi-plugin-ezforms is vulnerable to authentication bypass. The vulnerability exists due to improper capture validation which allows a malicious user to login into the system using unauthorized capture...

GHSA-8MGQ-6R2Q-82W9 Captcha Bypass in strapi-plugin-ezforms

Impact Users using any captcha providers Patches 0.1.0 References Issue...

Captcha Bypass in strapi-plugin-ezforms

Impact Users using any captcha providers Patches 0.1.0 References Issue...

PT-2022-28221 · Strapi · Strapi-Plugin-Ezforms

Name of the Vulnerable Software and Affected Versions: strapi-plugin-ezforms versions prior to 0.1.0 Description: The issue affects users utilizing any captcha providers. There is no information available about the estimated number of potentially affected devices or real-world incidents where thi...

@trycar-packages-org/tc-entities-production (=1.0.93), otp-generator-strapi (>=1.0.0 <=1.0.1) +12 more potentially affected by CVE-2021-23451 via otp-generator (>=1.1.0 <=2.0.1)

otp-generator NPM version =1.1.0, =1.0.0, =1.0.4, =1.0.1, =1.0.1, =1.0.80, =0.0.1, =1.2.0, =1.0.1, =1.0.5 Source cves: CVE-2021-23451 Source advisory: OSV:GHSA-6X93-H9G3-9PHR...

Arbitrary File Upload

strapi is vulnerable to arbitrary file upload. The vulnerability exists in the module.exports function in content-api.js due to improper validation of the upload files, allowing an attacker to upload a maliciously crafted file and remotely execute arbitrary code on the system...

@beardeddudes/strapi-types (=0.1.0), @bimbeo160/admin (=4.12.2) +49 more potentially affected by CVE-2022-32114 via @strapi/strapi (>=0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b <=4.1.12)

@strapi/strapi NPM version =0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b, =4.12.2, =1.0.9, =1.0.0-alpha.0, =1.1.0, =4.12.4-lakileki.1, =3.5.2, =1.0.1, =1.0.8, =1.0.81 and more Source cves: CVE-2022-32114 Source advisory: OSV:GHSA-4VM8-J95F-J6V5...

GHSA-4VM8-J95F-J6V5 Strapi 4.1.12 Cross-site Scripting via crafted file

An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. After an authenticated attacker uploads a file containing a malicious URL, a victim copies and pastes the malicious URL into a new tab to recei...

Strapi 4.1.12 Cross-site Scripting via crafted file

An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. After an authenticated attacker uploads a file containing a malicious URL, a victim copies and pastes the malicious URL into a new tab to recei...

CVE-2022-32114

An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create upload" permission is supposed to be able to upload PDF fil...

Unrestricted file upload

DISPUTED An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create upload" permission is supposed to be able to uploa...

Strapi 代码问题漏洞

Strapi is an open source content management system CMS. A code issue vulnerability exists in Strapi v4.1.12, which stems from an unrestricted upload of files, and can be exploited by an attacker to execute arbitrary code via a crafted file...

CVE-2022-32114

An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create upload" permission is supposed to be able to upload PDF fil...

CVE-2022-32114

An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create upload" permission is supposed to be able to upload PDF fil...

CVE-2022-32114

CVE-2022-32114 describes an unrestricted file upload in Strapi 4.1.12 via the Add New Assets function, enabling an attacker to cause XSS by uploading a crafted PDF. The notes indicate that media upload permissions and public assets exposure can influence risk, with potential to upload PDFs contai...

Malicious code in strapi-provider-upload-aws-s3-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1d24b53a4fdd8c047f1239905fddd51ae8f1cb40bc6e5de7f014a3c4d9595aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6322 Malicious code in strapi-provider-upload-aws-s3-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1d24b53a4fdd8c047f1239905fddd51ae8f1cb40bc6e5de7f014a3c4d9595aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...