Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/52381?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/52381?format=api", "purl": "pkg:nuget/Kentico.Libraries@9.0.0", "type": "nuget", "namespace": "", "name": "Kentico.Libraries", "version": "9.0.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "10.0.48", "latest_non_vulnerable_version": "11.0.45", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39519?format=api", "vulnerability_id": "VCID-d2gk-j16z-v3dn", "summary": "Direct Request ('Forced Browsing')\nKentico allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.", "references": [ { "reference_url": "https://blog.hivint.com/advisory-access-control-bypass-in-kentico-cms-cve-2017-17736-49e1e43ae55b", "reference_id": "", "reference_type": "", "scores": [], "url": "https://blog.hivint.com/advisory-access-control-bypass-in-kentico-cms-cve-2017-17736-49e1e43ae55b" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17736", "reference_id": "CVE-2017-17736", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17736" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55256?format=api", "purl": "pkg:nuget/Kentico.Libraries@10.0.48", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Kentico.Libraries@10.0.48" } ], "aliases": [ "CVE-2017-17736" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-d2gk-j16z-v3dn" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/54139?format=api", "vulnerability_id": "VCID-5hqx-8wgy-dyeh", "summary": "SQL Injection\nThe Blog module in Kentico CMS R2 build allows SQL injection via the tagname parameter.", "references": [ { "reference_url": "https://kontent.ai", "reference_id": "", "reference_type": "", "scores": [], "url": "https://kontent.ai" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27581", "reference_id": "CVE-2021-27581", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27581" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52381?format=api", "purl": "pkg:nuget/Kentico.Libraries@9.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-d2gk-j16z-v3dn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Kentico.Libraries@9.0.0" } ], "aliases": [ "CVE-2021-27581" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5hqx-8wgy-dyeh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37929?format=api", "vulnerability_id": "VCID-nb35-xzmj-x7fq", "summary": "Open Redirect\nOpen redirect vulnerability in CMSPages/GetDocLink.ashx in Kentico CMS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the link parameter.", "references": [ { "reference_url": "http://packetstormsecurity.com/files/133981/Kentico-CMS-8.2-Cross-Site-Scripting-Open-Redirect.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://packetstormsecurity.com/files/133981/Kentico-CMS-8.2-Cross-Site-Scripting-Open-Redirect.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7823", "reference_id": "CVE-2015-7823", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7823" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52381?format=api", "purl": "pkg:nuget/Kentico.Libraries@9.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-d2gk-j16z-v3dn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Kentico.Libraries@9.0.0" } ], "aliases": [ "CVE-2015-7823" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nb35-xzmj-x7fq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37928?format=api", "vulnerability_id": "VCID-ydpt-ecu4-bkb1", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nMultiple cross-site scripting (XSS) vulnerabilities in Kentico CMS allow remote attackers to inject arbitrary web script or HTML via a (1) parameter name to CMSModules/AdminControls/Pages/UIPage.aspx or the (2) CMSBodyClass cookie variable to the default URI.", "references": [ { "reference_url": "http://packetstormsecurity.com/files/133981/Kentico-CMS-8.2-Cross-Site-Scripting-Open-Redirect.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://packetstormsecurity.com/files/133981/Kentico-CMS-8.2-Cross-Site-Scripting-Open-Redirect.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7822", "reference_id": "CVE-2015-7822", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7822" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52381?format=api", "purl": "pkg:nuget/Kentico.Libraries@9.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-d2gk-j16z-v3dn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Kentico.Libraries@9.0.0" } ], "aliases": [ "CVE-2015-7822" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ydpt-ecu4-bkb1" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Kentico.Libraries@9.0.0" }