ApostropheCMS: Page REST API authorization bypass

Summary The core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public...

PT-2013-6119

Name of the Vulnerable Software and Affected Versions Jamroom versions prior to 1.1.1 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the search string parameter to the "search/results/all/1/4" API endpoint. Recommendations...