DOM XSS in Theme Preview

Impact An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they'...

CVE-2021-29484

Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and m...

CVE-2021-29484

Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and m...

Code injection

Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and m...

CVE-2021-29484 DOM XSS in Theme Preview

Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and m...

CVE-2021-29484

Ghost CMS vulnerable影 DOM-based XSS (CVE-2021-29484) affecting Ghost 4.0.0 to 4.3.2 via an unused /ghost/preview endpoint. The admin frontend’s theme preview listens for postMessage without origin validation, allowing a logged-in admin to be compromised when visiting a malicious site. A fix was a...

PT-2021-18246 · Ghost · Ghost

Name of the Vulnerable Software and Affected Versions: Ghost versions 4.0.0 through 4.3.2 Description: An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click...

Ghost CMS 跨站脚本漏洞

Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. Ghost CMS suffers from a cross-site scripting vulnerability that can be exploited by an attacker to gain access by having a logged-in user click on a link containing...

Command Execution Vulnerability in the ghost plugin of YMail Email System

E-Mail Email System is a mail system software developed by E-Mail. A command execution vulnerability exists in the ghost plugin of YMS Email System, which can be exploited by attackers to gain control of the server...

SUSE: Security Advisory (SUSE-SU-2021:0736-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Nefilim Ransomware Gang Hits Jackpot with Ghost Account

A Nefilim ransomware attack that locked up more than 100 systems stemmed from the compromise of an unmonitored account belonging to an employee who had died three months previously, researchers said. Nefilim a.k.a. Nemty is a ransomware strain that emerged in 2020, with its operators adopting the...

CVE-2020-35185

The official ghost docker images before 2.16.1-alpine Alpine specific contain a blank password for a root user. System using the ghost docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2020-35185

The official ghost docker images before 2.16.1-alpine Alpine specific contain a blank password for a root user. System using the ghost docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

Default credentials

The official ghost docker images before 2.16.1-alpine Alpine specific contain a blank password for a root user. System using the ghost docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2020-35185

The CVE-2020-35185 entry is corroborated by multiple connected documents: Ghost Docker images prior to 2.16.1-alpine contain a blank root password , enabling a remote attacker to gain root access in affected deployments using the Ghost Docker container. No exploitation details are provided beyond...

CVE-2020-35185

The official ghost docker images before 2.16.1-alpine Alpine specific contain a blank password for a root user. System using the ghost docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

Docker Image ghost Access Control Error Vulnerability

Docker is an open source application container engine from the American company Docker. The product supports creating a container lightweight virtual machine and deploying and running applications on Linux systems, as well as automating the installation, deployment, and upgrading of applications...

45 Million Medical Images Left Exposed Online

More than 45 million medical images—and the personally identifiable information PII and personal healthcare information PHI associated with them–have been left exposed online due to unsecured technology that’s typically used to store, send and receive medical data, new research has found. A team...

Xenstore: guests can disturb domain cleanup

ISSUE DESCRIPTION Xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this protocol, xenstored will drop the connection to that guest. Unfortunately this is done by just removing the guest from xenstored's internal management, resulting in th...

@patrick91/ghost (=5.2.3-patrick.1), @tryghost/settings-path-manager (>=0.1.0 <=0.1.9) +11 more potentially affected by unknown CVE via props (>=0.1.0 <=0.3.0)

props NPM version =0.1.0, =0.1.0, =0.0.0, =0.0.1-alpha1, =0.0.0, =4.24.0, =0.0.1, =0.0.4, =0.1.1, =0.1.0, =0.1.0, =0.1.11 Source cves: unknown CVE Source advisory: SNYK:JS-PROPS-1015750...