22 matches found
GHSA-HHPH-8536-GFQ5 ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
Summary When uploadfs is configured with the Azure backend and sas: true a supported configuration introduced in uploadfs 1.25.0, createContainer builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result...
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
Summary When uploadfs is configured with the Azure backend and sas: true a supported configuration introduced in uploadfs 1.25.0, createContainer builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result...
npm: ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
npm: ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL sas: true vulnerability discovered by ? in WordPress npm uploadfs versions = 1.25.0, 1.28.0...
Insufficiently Protected Credentials
Overview uploadfs is a Store files in a web-accessible location via a simplified API. Can automatically scale and rotate images. Includes S3, Azure and local filesystem-based backends with the most convenient features of each. Affected versions of this package are vulnerable to Insufficiently...
CVE-2026-113652
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer builds the BlobServiceClient from a...
CVE-2026-113652 ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer builds the BlobServiceClient from a...
EUVD-2026-105180
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer builds the BlobServiceClient from a...
CVE-2026-113652 ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer builds the BlobServiceClient from a...
CVE-2026-113652
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer builds the BlobServiceClient from a...
CVE-2026-113652
The ApostropheCMS content management system (Node.js) is vulnerable in versions 1.25.0 through 1.27.x . When using the uploadfs Azure backend with sas: true, the createContainer() function builds a BlobServiceClient from a URL that embeds a full account-level SAS token . Due to how Azure SDK v12 ...
CVE-2026-113652 ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer builds the BlobServiceClient from a...
PT-2026-120310
Summary When uploadfs is configured with the Azure backend and sas: true a supported configuration introduced in uploadfs 1.25.0, createContainer builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result...
PT-2026-118497
Name of the Vulnerable Software and Affected Versions ApostropheCMS versions 1.25.0 through 1.27.0 Description When the uploadfs component is configured with the Azure backend and the sas variable is set to true, the createContainer function builds the BlobServiceClient using a URL that includes...
EUVD-2021-1091
Malware in sbrugna...
CVE-2019-19316
When using the Azure backend with a shared access signature SAS, Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP...
OPENSUSE-SU-2025:0091-1 Security update for restic
This update for restic fixes the following issues: - Fixed CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 boo1239264 - Update to version 0.17.3 - Fix 4971: Fix unusable mount on macOS Sonoma - Fix 5003: Fix metadata errors during...
SUSE CVE-2011-3649
Mozilla Firefox 7.0 and Thunderbird 7.0, when the Direct2D aka D2D API is used on Windows in conjunction with the Azure graphics back-end, allow remote attackers to bypass the Same Origin Policy, and obtain sensitive image data from a different domain, by inserting this data into a canvas. NOTE:...
SUSE CVE-2019-19316
When using the Azure backend with a shared access signature SAS, Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP...
Use of a Broken or Risky Cryptographic Algorithm in Terraform
When using the Azure backend with a shared access signature SAS, Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP. Specific Go Packages Affected github.com/hashicorp/terraform/backend/remote-state/azure...