CVE-2023-25571

Backstage is an open platform for building developer portals. @backstage/catalog-model prior to version 1.2.0, @backstage/core-components prior to 0.12.4, and @backstage/plugin-catalog-backend prior to 1.7.2 are affected by a cross-site scripting vulnerability. This vulnerability allows a malicio...

Cross site scripting

Backstage is an open platform for building developer portals. @backstage/catalog-model prior to version 1.2.0, @backstage/core-components prior to 0.12.4, and @backstage/plugin-catalog-backend prior to 1.7.2 are affected by a cross-site scripting vulnerability. This vulnerability allows a malicio...

CVE-2023-25571

CVE-2023-25571 affects Backstage components: @backstage/catalog-model <1.2.0, @backstage/core-components <0.12.4, and @backstage/plugin-catalog-backend

CVE-2023-25571 Backstage has XSS Vulnerability in Software Catalog

Backstage is an open platform for building developer portals. @backstage/catalog-model prior to version 1.2.0, @backstage/core-components prior to 0.12.4, and @backstage/plugin-catalog-backend prior to 1.7.2 are affected by a cross-site scripting vulnerability. This vulnerability allows a malicio...

CVE-2023-25571 Backstage has XSS Vulnerability in Software Catalog

Backstage is an open platform for building developer portals. @backstage/catalog-model prior to version 1.2.0, @backstage/core-components prior to 0.12.4, and @backstage/plugin-catalog-backend prior to 1.7.2 are affected by a cross-site scripting vulnerability. This vulnerability allows a malicio...

CVE-2023-25571 Backstage has XSS Vulnerability in Software Catalog

Backstage is an open platform for building developer portals. @backstage/catalog-model prior to version 1.2.0, @backstage/core-components prior to 0.12.4, and @backstage/plugin-catalog-backend prior to 1.7.2 are affected by a cross-site scripting vulnerability. This vulnerability allows a malicio...

backstage 跨站脚本漏洞

backstage is an application. Backstage is an open platform for building developer portals. A security vulnerability exists in backstage catalog-model prior to 1.2.0, backstage core-components prior to 0.12.4, and backstage plugin-catalog-backend prior to 1.7.2 that originates from a vulnerability...

PT-2023-20170 · Unknown · @Backstage/Plugin-Catalog-Backend +2

Name of the Vulnerable Software and Affected Versions: @backstage/catalog-model versions prior to 1.2.0 @backstage/core-components versions prior to 0.12.4 @backstage/plugin-catalog-backend versions prior to 1.7.2 Description: This issue allows a malicious actor with access to add or modify conte...

Critical RCE Flaw Reported in Spotify's Backstage Software Catalog and Developer Platform

Spotify's Backstage has been discovered as vulnerable to a severe security flaw that could be exploited to gain remote code execution by leveraging a recently disclosed bug in a third-party module. The vulnerability CVSS score: 9.8, at its core, takes advantage of a critical sandbox escape in vm2...

backstage 安全漏洞

backstage is an application. Backstage is an open platform for building developer portals. A security vulnerability exists in backstage, which stems from the fact that an attacker can probe internal network services through carefully crafted data implementations...

CVE-2022-39345

Gin-vue-admin pre-2.5.4 is vulnerable to a path-traversal/file-upload flaw. The Unzip routine decompresses uploaded zips without validating contents, enabling Zip Slip-style traversal to overwrite arbitrary files. Affected versions:

PT-2022-4708

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.9.11 Description The issue is related to insufficient resource control with dynamic management in the vm2 library, allowing a remote attacker to execute arbitrary code by bypassing sandbox protections. The vulnerability...

backstageauctions.com Cross Site Scripting vulnerability OBB-2683579

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

@backstage-community/plugin-techdocs-backend-module-confluence (>=0.2.0 <=0.2.1), @backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20230323021924 <=0.4.15-next.0) +13 more potentially affected by unknown CVE via @backstage/plugin-techdocs-node (>=0.0.0-nightly-20220315022536 <=1.1.2-next.2)

@backstage/plugin-techdocs-node NPM version =0.0.0-nightly-20220315022536, =0.2.0, =0.0.0-nightly-20230323021924, =0.0.0-nightly-202111212297, =0.0.0-nightly-20220305022735, =1.0.0, =1.0.1, =1.6.0, =0.0.4, =1.9.1, =1.0.1, =1.0.1, =0.0.0-nightly-2022122206, =0.1.5, =0.1.2, =1.1.0 Source cves:...

@backstage/plugin-techdocs (>=0.0.0-nightly-2021242250 <=0.0.0-nightly-2020112923923), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021112332 <=0.14.1) +1 more potentially affected by unknown CVE via @backstage/techdocs-common (>=0.0.0-nightly-20220923026 <=0.11.15)

@backstage/techdocs-common NPM version =0.0.0-nightly-20220923026, =0.0.0-nightly-2021242250, =0.0.0-nightly-2021112332, =0.0.0-nightly-2022122206, =0.8.16 Source cves: unknown CVE Source advisory: OSV:GHSA-4JQC-JVH2-PXG9...

CVE-2022-24843 Path Traversal in github.com/flipped-aurora/gin-vue-admin

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary file read vulnerability due to a lack of parameter validation. This has been resolved in version 2.5.1. There are no known workarounds for th...

CVE-2022-21660 Missing authorization in gin-vue-admin

Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the setUserInfo function. Users are advised to update as soon as possible. There are no known workarounds...

CVE-2022-21660

Gin-vue-admin, a Vue/Gin-based backstage management system, is vulnerable prior to version 2.4.7 due to missing authentication on the SetUserInfo endpoint, allowing a low-privilege user to modify higher-privilege accounts. The issue stems from not validating the target user ID in SetUserInfo, com...

CVE-2022-21660 Missing authorization in gin-vue-admin

Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the setUserInfo function. Users are advised to update as soon as possible. There are no known workarounds...

Remote Code Execution (RCE)

@backstage/plugin-scaffolder-backend is vulnerable to remote code execution attacks. A malicious user with write access to a registered scaffolder template could manipulate the template...