@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +81 more potentially affected by CVE-2024-29181 via @strapi/plugin-content-manager (>=4.0.0, <=4.19.0)

@strapi/plugin-content-manager NPM version =4.0.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.1 - @cowprotocol/cms 0.1.0-rc.5 and more Source cves: CVE-2024-29181 Source advisory: OSV:GHSA-6J89-FRXC-Q26M...

CVE-2024-29181: Authorization Bypass Through User-Controlled Key

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +52 more potentially affected by CVE-2023-37263 via @strapi/plugin-content-manager (>=4.0.0, <=4.12.0-beta.5)

@strapi/plugin-content-manager NPM version =4.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.9.2, =4.9.2, =4.10.10 and more Source cves: CVE-2023-37263 Source advisory: OSV:GHSA-M284-85MF-CGRC...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +49 more potentially affected by CVE-2023-36472 via @strapi/plugin-content-manager (>=4.0.0, <=4.11.6)

@strapi/plugin-content-manager NPM version =4.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.9.2, =4.9.2, =4.10.10 and more Source cves: CVE-2023-36472 Source advisory: OSV:GHSA-V8GG-4MQ2-88Q4...

@koj/strapi (>=0.0.0, <=1.4.0), strapi-editorjs (0.0.1) +1 more potentially affected by CVE-2020-27666 via strapi-plugin-content-manager (>=3.0.0-beta.18.7, <=3.1.6)

strapi-plugin-content-manager NPM version =3.0.0-beta.18.7, =0.0.0, =0.0.1-alpha.1, =0.0.1-alpha.2 Source cves: CVE-2020-27666 Source advisory: OSV:GHSA-QVP5-MM7V-4F36...