Origin Validation Error

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Origin Validation Error via getExternalFile in packages/payload/src/uploads/getExternalFile.ts, where the origin of an external file request URL is not validate...

Cross-site Scripting (XSS)

Overview @payloadcms/payload-cloud is a The official Payload Cloud plugin Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can upload a...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-gcs is a Payload storage adapter for Google Cloud Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker c...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-azure is a Payload storage adapter for Azure Blob Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker c...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-s3 is a Payload storage adapter for Amazon S3 Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can upload a...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-uploadthing is a Payload storage adapter for uploadthing Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker ca...

Cross-site Scripting (XSS)

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can...

Incorrect Authorization

Overview @payloadcms/plugin-multi-tenant is a Multi Tenant plugin for Payload Affected versions of this package are vulnerable to Incorrect Authorization via the tenantField default value logic in packages/plugin-multi-tenant/src/fields/tenantField/index.ts, where the return value of...

External Control of File Name or Path

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to External Control of File Name or Path via the deleteAssociatedFiles function in packages/payload/src/uploads/deleteAssociatedFiles.ts, where a filename stored i...

Overly Restrictive Account Lockout Mechanism

Overview @payloadcms/drizzle is an A library of shared functions used by different payload database adapters Affected versions of this package are vulnerable to Overly Restrictive Account Lockout Mechanism via the resetPassword operation, which fails to reset the account lockout state upon a...

Overly Restrictive Account Lockout Mechanism

Overview Affected versions of this package are vulnerable to Overly Restrictive Account Lockout Mechanism via the resetPassword operation, which fails to reset the account lockout state upon a successful password reset. An attacker who triggers repeated failed login attempts to lock an account ca...

Overly Restrictive Account Lockout Mechanism

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Overly Restrictive Account Lockout Mechanism via the resetPassword operation, which fails to reset the account lockout state upon a successful password reset. A...

Arbitrary File Upload

Overview @payloadcms/payload-cloud is a The official Payload Cloud plugin Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related file-type...

Arbitrary File Upload

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData an...

Arbitrary File Upload

Overview @payloadcms/storage-s3 is a Payload storage adapter for Amazon S3 Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related file-type...

Arbitrary File Upload

Overview @payloadcms/storage-uploadthing is a Payload storage adapter for uploadthing Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relate...

Arbitrary File Upload

Overview @payloadcms/storage-gcs is a Payload storage adapter for Google Cloud Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relat...

Arbitrary File Upload

Overview @payloadcms/storage-azure is a Payload storage adapter for Azure Blob Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relat...

Arbitrary File Upload

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related...

Arbitrary Code Injection

Overview @payloadcms/plugin-form-builder is a Form builder plugin for Payload CMS Affected versions of this package are vulnerable to Arbitrary Code Injection via insufficient access control on the FormSubmissions and Forms collections, where the read access check only verifies that a user is...

Missing Authorization

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Missing Authorization via the reorder endpoint in packages/payload/src/config/orderable/index.ts, where access control checks on update operations are...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via getFieldsToSign in the JWT authentication layer, where user-controlled fields...

Improper Verification of Cryptographic Signature

Overview @backstage/plugin-auth-backend-module-cloudflare-access-provider is a The cloudflare-access-provider backend module for the auth plugin. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the jwtVerify call in helpers.ts, which verifi...

Server-side Request Forgery (SSRF)

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via unsanitized MkDocs plugin entries in mkdocs.yml during...

Incorrect Authorization

Overview @backstage/plugin-proxy-backend is an A Backstage backend plugin that helps you set up proxy endpoints in the backend Affected versions of this package are vulnerable to Incorrect Authorization via inconsistent application of route credentials in the proxy router...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the getLocationEntity method and the event-driven update path in BitbucketServerEntityProvider.ts, where repository filters projectKey, repoSlug, and skipArchivedRepos configured by an administrator are appli...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the apiBaseUrl input parameter in the createSentryCreateProjectAction and fetchDSN scaffolder actions, which previously accepted an arbitrary caller-supplied URL without validating it against the...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the TIFF CCITT Group 4 T6 encoding process. An attacker can cause process termination and denial of service by supplying a specially crafted 1x1 Group 4 TIFF image that, when decoded and re-encoded, triggers...

Sensitive Information in Resource Not Removed Before Reuse

Overview Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse in the ExrDecoderCore process when handling ZIP-compressed OpenEXR images. An attacker can access sensitive memory contents from prior operations by submitting a crafted image...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the ICC color profile conversion process when handling a malformed embedded ICC LUT16 profile with more than four output channels. An attacker can cause memory corruption and application termination by supplying a...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop through the ReadValues64 process. An attacker can cause the decoder to enter a non-progressing loop by supplying a crafted BigTIFF file with a large IFD entry count, resulting in excessive resource consumption and potentia...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the TIFF CCITT Group 3 T4 encoding process. An attacker can cause memory corruption and terminate the process by providing specially crafted 1-bit image data with narrow width and a large number of rows, leading t...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write through the HistogramEqualization process. An attacker can cause the application to terminate unexpectedly by supplying a specially crafted 32-bit floating-point TIFF image with non-finite values, which leads to an...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through the ICC profile parsing process. An attacker can cause excessive memory allocation by supplying a specially crafted image with a malformed embedded ICC profile, leading to increased...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via PassportHelpers.ts in the makeProfileInfo function, which fails to check the verified flag on OAuth profile emails and the emailverified claim in ID tokens before accepting them as...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the set method, which fails to restrict path segments to own properties. When a path crosses a primitive value, assigning a proto segment silently descends into the primitive's built-in prototype rather than...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the set method, which fails to restrict path segments to own properties. When a path crosses a primitive value, assigning a proto segment silently descends into the primitive's built-in prototype rather than...

Insertion of Sensitive Information Into Sent Data

Overview org.postgresql:postgresql is a Java JDBC 4.2 JRE 8+ driver for PostgreSQL database. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the process of handling GSS-encrypted connections when writing large values from a byte array. An...

Server-side Request Forgery (SSRF)

Overview weasyprint is a The Awesome Document Factory Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via EPS image rendering in weasyprint/images.py, which invokes Ghostscript to process EPS images. An attacker who can supply a malicious EPS image to be...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via...

Deserialization of Untrusted Data

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Deserialization of Untrusted Data in sanitizeMkdocsYml within mkdocsPatchers.ts via malforme...

External Control of File Name or Path

Overview @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to External Control of File Name or Path via the getAndWriteAttachments function in...

Directory Traversal

Overview @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Directory Traversal via parsedRepoUrl.filepath in confluenceToMarkdown.ts, where...

Incorrect Authorization

Overview @backstage/plugin-search-backend is a The Backstage backend plugin that provides your backstage app with search Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizedSearchEngine when all document types are denied by authorization policy. An authenticat...

Incorrect Authorization

Overview @backstage/plugin-search-backend-module-elasticsearch is an A module for the search backend that implements search using ElasticSearch Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizedSearchEngine when all document types are denied by authorization...

Missing Authorization

Overview @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes Affected versions of this package are vulnerable to Missing Authorization via the Kubernetes objects endpoint in KubernetesRouter, where the entity field supplied in the request body ...

Incorrect Authorization

Overview @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes Affected versions of this package are vulnerable to Incorrect Authorization via the sanitizeKubernetesResponse method in KubernetesFetcher.ts, where Kubernetes Secret values are not...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via SCM scaffolder actions in bitbucketServer.ts and related action files, where the actions fall back to server-side integration credentials when no user-supplied token is provided. An authenticated attacker can...

Incorrect Authorization

Overview @backstage/plugin-scaffolder-backend-module-github is a The github module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Incorrect Authorization via SCM scaffolder actions in bitbucketServer.ts and related action files, where the actions fall...