Ghost CMS 代码问题漏洞

Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. A code issue vulnerability exists in Ghost v4.39.0 that allows an attacker to execute arbitrary code via a crafted SVG file...

PT-2022-19000

Name of the Vulnerable Software and Affected Versions Ghost CMS version 4.42.0 Description An arbitrary file upload vulnerability in the file upload module of Ghost CMS allows attackers to execute arbitrary code via a crafted file. The vendor states that files can only be uploaded and published b...

CVE-2022-27139: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...

Security Bulletin: GNU C library (glibc) vulnerability affects Tivoli Storage Productivity Center (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects Tivoli Storage Productivity Center. Vulnerability Details Vulnerability Details CVEID: CVE-2015-0235 DESCRIPTION:The gethostbyname functions of the GNU C Library glibc are vulnerable to a buffer overflow. By...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4j-RCE Log4j RCE - CVE-2021-44228 !Test Image 1https:/...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft

This repository is a proof-of-concept PoC exploit for CVE-2020-0796, also known as SMBGhost, a pre-authentication remote code execution vulnerability in Windows SMBv3. The exploit is written in Python and uses the SMB protocol to exploit the vulnerability. The PoC is intended for demonstration...

GPAC 缓冲区错误漏洞

GPAC is an open source multimedia framework. gpac suffers from a buffer overflow vulnerability that stems from an issue discovered in gpac 0.8.0. The GetGhostNum function in stblread.c has a heap-based buffer overflow that can be exploited by an attacker to cause a denial of service DOS via craft...

7ghost (>=4.11.0, <=4.11.46), @heroku-cli/plugin-java (>=3.0.0, <=3.1.1) +49 more potentially affected by CVE-2021-41117 via keypair (>=1.0.0, <=1.0.3)

keypair NPM version =1.0.0, =4.11.0, =3.0.0, =2.3.1, =3.41.6, =1.0.1, =1.0.0, =0.1.2, =0.2.1, =0.4.0, =0.1.2, =0.1.2, =0.1.11 and more Source cves: CVE-2021-41117 Source advisory: OSV:GHSA-3F99-HVG4-QJWJ...

Member account takeover

Impact An error in the implementation of the member email change functionality allows unauthenticated users to change the email address of arbitrary member accounts to one they control by crafting a request to the relevant API endpoint, and validating the new address via magic link sent to the ne...

PT-2021-24388

Name of the Vulnerable Software and Affected Versions: Ghost versions 3.18.0 through 4.15.0 Description: An error in the implementation of the member email change functionality allows unauthenticated users to change the email address of arbitrary member accounts by crafting a request to the...

Remote Code Execution (RCE)

ghost is vulnerable to remote code execution. The vulnerability exists due to a command injection in nodemailer dependency which allows scripts to be executed in the constructor of the GhostMailer function...

PT-2021-24466

Name of the Vulnerable Software and Affected Versions: Ghost versions prior to 4.15.0 Description: The issue affects sites using the sendmail transport as part of their mail config, making them vulnerable to remote command injection due to a problem in the nodemailer dependency. Ghost defaults to...

CVE-2021-39192

Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users including contributors to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability...

CVE-2021-39192

Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users including contributors to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability...

Privilege escalation

Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users including contributors to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability...

CVE-2021-39192

Ghost CMS contains a privilege-escalation flaw in the limits service from versions 4.0.0–4.9.4 that lets all authenticated users (including contributors) view admin-level API keys via the Integrations API endpoint. The issue is fixed in Ghost 4.10.0. As a workaround, disable all non-Administrator...

CVE-2021-39192 Privilege escalation: all users can access Admin-level API keys

Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users including contributors to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability...

CVE-2021-39192

Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users including contributors to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability...

CVE-2021-39192: Exposure of Sensitive Information to an Unauthorized Actor

Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users including contributors to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability...

Ghost CMS 信息泄露漏洞

Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. An information disclosure vulnerability exists in Ghost versions 4.0.0 through 4.9.4, which stems from an error in the implementation of the LIMITS service that allows...