@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +52 more potentially affected by CVE-2023-37263 via @strapi/plugin-content-manager (>=4.0.0, <=4.12.0-beta.5)

@strapi/plugin-content-manager NPM version =4.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.9.2, =4.9.2, =4.10.10 and more Source cves: CVE-2023-37263 Source advisory: OSV:GHSA-M284-85MF-CGRC...

@chargeover/strapi (0.0.1-rc1.1), @mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0, <=1.0.0-alpha.3) +7 more potentially affected by CVE-2023-22621 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.5.1)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =1.0.2 - easylaser-vn-cms 0.1.0 - strapi-ent-a 0.1.0 - strapi-fcm 0.1.0 - strapi-voting 0.2.1 - sveltekit-strapi 0.1.0 Source cves: CVE-2023-22621 Source advisory: OSV:GHSA-2H87-4Q2W-V4HF...

Authentication Bypass

strapi-plugin-ezforms is vulnerable to authentication bypass. The vulnerability exists due to improper capture validation which allows a malicious user to login into the system using unauthorized capture...

Captcha Bypass in strapi-plugin-ezforms

Impact Users using any captcha providers Patches 0.1.0 References Issue...

GHSA-8MGQ-6R2Q-82W9 Captcha Bypass in strapi-plugin-ezforms

Impact Users using any captcha providers Patches 0.1.0 References Issue...

CVE-2021-46440

Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to...

CVE-2021-46440

Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to...

Insecure Authorization

strapi-plugin-content-type-builder suffers from insecure authorization. The admin::hasPermissions restriction for the content-type-builder CTB routes are not configured, allowing unauthorized access to the affected resources...

@koj/strapi (>=0.0.0, <=1.4.0), strapi-editorjs (0.0.1) +1 more potentially affected by CVE-2020-27666 via strapi-plugin-content-manager (>=3.0.0-beta.18.7, <=3.1.6)

strapi-plugin-content-manager NPM version =3.0.0-beta.18.7, =0.0.0, =0.0.1-alpha.1, =0.0.1-alpha.2 Source cves: CVE-2020-27666 Source advisory: OSV:GHSA-QVP5-MM7V-4F36...

@koj/strapi (>=0.0.0, <=1.4.0) potentially affected by CVE-2020-27665 via strapi-plugin-content-type-builder (3.1.6)

strapi-plugin-content-type-builder NPM version 3.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on strapi-plugin-content-type-builder and may be impacted: - @koj/strapi =0.0.0, =1.4.0 Source cves: CVE-2020-27665 Source advisory: OSV:GHSA-4P55-XJ37-FX...

Unsecured Proxy

strapi-plugin-upload contains an unsecured proxy. An unauthenticated user is able to access the proxy without any authorization, allowing for access to other protected resources...