Denial of Service

Overview Versions of apostrophe prior to 2.97.1 are vulnerable to Denial of Service. The apostrophe-jobs module sets a callback for incoming jobs and doesn't clear it regardless of its status. This causes the server to accumulate callbacks, allowing an attacker to start a large number of jobs and...

Open Redirect

Overview Versions of apostrophe prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing / were appended at the end. Recommendation Update to version 2.92.0 or later. References - Snyk Report - GitHub Commit -...

Open Redirection

apostrophe is vulnerable to Open Redirection. This is because of a redirection when the url contains trailing slashes. The attacker is thus able to craft a malicious ulr to trick apostrophe to parse the url into the attacker's intended domain...

apostrophe (>=0.5.235, <=0.5.299), apostrophe-tumblr (>=0.5.1, <=0.5.13) +5 more potentially affected by CVE-2017-16016 via sanitize-html (>=1.1.4, <=1.10.1)

sanitize-html NPM version =1.1.4, =0.5.235, =0.5.1, =0.1.0-beta.6, =0.5.1, =0.0.1, =0.0.9 Source cves: CVE-2017-16016 Source advisory: OSV:GHSA-XC6G-GGRC-QQ4R...

apostrophe-tumblr (>=0.5.1, <=0.5.13) potentially affected by CVE-2017-16017 via sanitize-html (1.1.4)

sanitize-html NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - apostrophe-tumblr =0.5.1, =0.5.13 Source cves: CVE-2017-16017 Source advisory: OSV:GHSA-WG96-3933-J2W5...

Cross site scripting

Cross-site scripting XSS vulnerability in the preview form in Stephen Ostermiller Contact Form before 2.00.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that contain an apostrophe...