Exploit for OS Command Injection in Strapi

CVE-2019-19609 Strapi Framework Vulnerable to Remote Code Exec...

Exploit for OS Command Injection in Strapi

CVE-2019-19609 Strapi Framework Vulnerable to Remote Code Exec...

Exploit for OS Command Injection in Strapi

CVE-2019-19609 Strapi Framework Vulnerable to Remote Code Exec...

Authorization Bypass

Overview admin/src/containers/InputModalStepperProvider/index.js in strapi before 3.2.5 has unwanted /proxy?url= functionality. Recommendation Upgrade to version 3.2.5 or later References - CVE - GitHub Advisory...

@koj/strapi (>=0.0.0, <=1.4.0), @symbol-it/strapi-plugin-mailjet (>=0.0.1, <=0.0.2) +5 more potentially affected by CVE-2020-27664 via strapi (>=3.0.0, <=3.1.6)

strapi NPM version =3.0.0, =0.0.0, =0.0.1, =0.0.34, =0.0.1-alpha.1, =0.0.1-alpha.2 - strapi-plugin-mailjet 0.0.2 Source cves: CVE-2020-27664 Source advisory: OSV:GHSA-7FRV-9PHW-VRVR...

GHSA-7FRV-9PHW-VRVR Authorization bypass in Strapi

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...

Authorization bypass in Strapi

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...

@codious/core (>=1.0.6, <=1.2.6), @koj/strapi (>=1.4.1, <=1.4.3) +6 more potentially affected by CVE-2021-26540 via sanitize-html (>=2.1.0, <=2.3.1)

sanitize-html NPM version =2.1.0, =1.0.6, =1.4.1, =3.37.0, =2.1.56, =2.0.58, =0.12.0, =3.2.5, =3.5.2 Source cves: CVE-2021-26540 Source advisory: OSV:GHSA-MJXR-4V3X-Q3M4...

@codious/core (>=1.0.6, <=1.2.4), @koj/strapi (>=1.4.1, <=1.4.3) +6 more potentially affected by CVE-2021-26539 via sanitize-html (>=2.1.0, <=2.3.0)

sanitize-html NPM version =2.1.0, =1.0.6, =1.4.1, =3.37.0, =2.1.56, =2.0.58, =0.12.0, =3.2.5, =3.5.2 Source cves: CVE-2021-26539 Source advisory: OSV:GHSA-RJQQ-98F6-6J3R...

CVE-2021-28128

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password...

CVE-2021-28128

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password...

Default credentials

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password...

CVE-2021-28128

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password...

CVE-2021-28128

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password...

CVE-2021-28128

Strapi up to version 3.6.0 contains an auth weakness in the admin panel: a user can change their own password without entering the current one. If an attacker gains any valid session, they can take over the account by changing the password. This aligns with the CVSS3.1/8.1 (HIGH) impact noted in ...

CVE-2021-28128

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password...

CVE-2021-28128: Weak Password Recovery Mechanism for Forgotten Password

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password...

Strapi 授权问题漏洞

Strapi is an open source headless content management system CMS. A security vulnerability exists in Strapi version 3.6.0 and prior versions that allows an attacker who gains valid session access to take over an account by changing the password...

PT-2021-17761

Name of the Vulnerable Software and Affected Versions: Strapi versions prior to 3.6.1 is not mentioned, however, the version 3.6.0 is mentioned as vulnerable, so we can say Strapi versions 3.6.0 and earlier Description: The admin panel in Strapi allows users to change their own password without...

Insecure Authorization

strapi-plugin-content-type-builder suffers from insecure authorization. The admin::hasPermissions restriction for the content-type-builder CTB routes are not configured, allowing unauthorized access to the affected resources...