Malicious code in strapi-plugin-workspace-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360f06861421eccfdc69a5f18ecfe67b3785cb24bb1b0d1e6dd3f5d65df20f20 The package strapi-plugin-workspace-plugin was found to contain malicious code. Source: ghsa-malware...

EUVD-2023-2899

Malicious code in bioql PyPI...

Denial-of-Service (DoS)

@strapi/plugin-upload is vulnerable to Denial-of-Service DoS. The vulnerability is due to the server crashing without restarting when handling errors, causing it to become unavailable for all clients until manually restarted...

@code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.4.3), @cowprotocol/cms (0.1.0-rc.5) +17 more potentially affected by CVE-2024-34065 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =0.0.1, =0.1.0, =0.1.10 and more Source cves: CVE-2024-34065 Source advisory: OSV:GHSA-WRVH-RCMR-9QFC...

@code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.4.3), @cowprotocol/cms (0.1.0-rc.5) +17 more potentially affected by CVE-2024-34065 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =0.0.1, =0.1.0, =0.1.10 and more Source cves: CVE-2024-34065 Source advisory: GHSA-WRVH-RCMR-9QFC...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +84 more potentially affected by CVE-2024-31217 via @strapi/plugin-upload (>=4.0.0-beta.0, <=4.21.1)

@strapi/plugin-upload NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-31217 Source advisory: OSV:GHSA-PM9Q-XJ9P-96PM...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +84 more potentially affected by CVE-2024-31217 via @strapi/plugin-upload (>=4.0.0-beta.0, <=4.21.1)

@strapi/plugin-upload NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-31217 Source advisory: GHSA-PM9Q-XJ9P-96PM...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +80 more potentially affected by CVE-2024-29181 via @strapi/plugin-content-manager (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-content-manager NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-29181 Source advisory: OSV:GHSA-6J89-FRXC-Q26M...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +80 more potentially affected by CVE-2024-29181 via @strapi/plugin-content-manager (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-content-manager NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-29181 Source advisory: GHSA-6J89-FRXC-Q26M...

CVE-2024-34065

Strapi is an open-source content management system. By combining two vulnerabilities an "Open Redirect" and "session token sent as URL query parameter" in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and...

@code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.4.3), @cowprotocol/cms (0.1.0-rc.5) +17 more potentially affected by CVE-2024-34065 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =0.0.1, =0.1.0, =0.1.10 and more Source cves: CVE-2024-34065 Source advisory: MEND:CVE-2024-34065...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +84 more potentially affected by CVE-2024-31217 via @strapi/plugin-upload (>=0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, <=4.21.1)

@strapi/plugin-upload NPM version =0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-31217 Source advisory: MEND:CVE-2024-31217...

CVE-2024-31217

Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause ...

CVE-2024-31217

CVE-2024-31217 is a DoS in Strapi’s media upload via @strapi/plugin-upload prior to version 4.22.0. The vulnerability can crash the server during file uploads without restart, affecting both development and production environments. The issue arises when errors are mishandled, causing the server t...

CVE-2024-29181

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +80 more potentially affected by CVE-2024-29181 via @strapi/plugin-content-manager (>=0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, <=4.19.0)

@strapi/plugin-content-manager NPM version =0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-29181 Source advisory: MEND:CVE-2024-29181...

CVE-2024-31217: Uncaught Exception

Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause ...

CVE-2024-34065: Authentication Bypass by Capture-replay

Strapi is an open-source content management system. By combining two vulnerabilities an Open Redirect and session token sent as URL query parameter in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and...

PT-2024-25676 · Strapi · @Strapi/Plugin-Users-Permissions

Name of the Vulnerable Software and Affected Versions: @strapi/plugin-users-permissions versions prior to 4.24.2 Description: The issue arises from combining two vulnerabilities in @strapi/plugin-users-permissions: an Open Redirect and a session token sent as a URL query parameter. This allows an...

CVE-2024-29181: Authorization Bypass Through User-Controlled Key

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...