942 matches found
Insecure Authorization
strapi-plugin-content-type-builder suffers from insecure authorization. The admin::hasPermissions restriction for the content-type-builder CTB routes are not configured, allowing unauthorized access to the affected resources...
Cross-site Scripting in Strapi
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature...
@koj/strapi (>=0.0.0, <=1.4.0), strapi-editorjs (0.0.1) +1 more potentially affected by CVE-2020-27666 via strapi-plugin-content-manager (>=3.0.0-beta.18.7, <=3.1.6)
strapi-plugin-content-manager NPM version =3.0.0-beta.18.7, =0.0.0, =0.0.1-alpha.1, =0.0.1-alpha.2 Source cves: CVE-2020-27666 Source advisory: OSV:GHSA-QVP5-MM7V-4F36...
GHSA-QVP5-MM7V-4F36 Cross-site Scripting in Strapi
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature...
Improper Authorization in Strapi
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...
@koj/strapi (>=0.0.0, <=1.4.0) potentially affected by CVE-2020-27665 via strapi-plugin-content-type-builder (3.1.6)
strapi-plugin-content-type-builder NPM version 3.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on strapi-plugin-content-type-builder and may be impacted: - @koj/strapi =0.0.0, =1.4.0 Source cves: CVE-2020-27665 Source advisory: OSV:GHSA-4P55-XJ37-FX...
GHSA-4P55-XJ37-FX7G Improper Authorization in Strapi
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...
Strapi Cross-Site Scripting Vulnerability
Strapi is an open source headless content management system CMS. A cross-site scripting vulnerability exists in Strapi versions prior to 3.2.5, which stems from the fact that Strapi has stored XSS in the preview feature of the WYSIWYG editor, which can be exploited by an attacker to obtain user...
Unsecured Proxy
strapi-plugin-upload contains an unsecured proxy. An unauthenticated user is able to access the proxy without any authorization, allowing for access to other protected resources...
Insecure Proxy
strapi uses insecure proxy. The vulnerability exists because access to proxy gives insecure access...
CVE-2020-27664
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...
CVE-2020-27665
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...
CVE-2020-27666
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature...
CVE-2020-27666
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature...
CVE-2020-27665
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...
CVE-2020-27664
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...
Design/Logic Flaw
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...
Code injection
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...
