Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/silverstripe/framework@3.2.1
Typecomposer
Namespacesilverstripe
Nameframework
Version3.2.1
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version3.2.4-rc1
Latest_non_vulnerable_version5.1.11
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-4n9x-x4kd-jyfu
vulnerability_id VCID-4n9x-x4kd-jyfu
summary 
XSS vulnerability in form field validation
A high level XSS risk has been identified in the encoding of validation messages in certain FormField classes. Certain fields such as the `NumericField` and `DropdownField` have been identified, but any form field which presents any invalid content as a part of its validation response will be at risk.
references
0
reference_url http://www.silverstripe.org/download/security-releases/ss-2015-026/
reference_id
reference_type
scores
url http://www.silverstripe.org/download/security-releases/ss-2015-026/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.1.16
purl pkg:composer/silverstripe/framework@3.1.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-hnhv-qx7p-wqcw
1
vulnerability VCID-rrmd-ud59-ffbp
2
vulnerability VCID-vatm-1vbd-bfam
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.1.16
1
url pkg:composer/silverstripe/framework@3.2.1
purl pkg:composer/silverstripe/framework@3.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.1
aliases SS-2015-026
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4n9x-x4kd-jyfu
1
url VCID-h4k6-fruf-uqff
vulnerability_id VCID-h4k6-fruf-uqff
summary 
Insufficient sanitization in "Add from URL"
"Add from URL" does not clearly sanitize URL server side in `HtmlEditorField_Toolbar`. The current logic will pass this through to Oembed, which will probably reject most dangerous URLs, but it's possible future changes would break this.
references
0
reference_url http://www.silverstripe.org/download/security-releases/ss-2015-027/
reference_id
reference_type
scores
url http://www.silverstripe.org/download/security-releases/ss-2015-027/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.1
purl pkg:composer/silverstripe/framework@3.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.1
aliases SS-2015-027
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-h4k6-fruf-uqff
2
url VCID-nu3h-nb1g-67bs
vulnerability_id VCID-nu3h-nb1g-67bs
summary 
Improper Input Validation
`HtmlEditor` improper URL sanitisation.
references
0
reference_url https://www.silverstripe.org/download/security-releases/ss-2015-027/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/ss-2015-027/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.1
purl pkg:composer/silverstripe/framework@3.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.1
aliases SS-2015-027-1
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nu3h-nb1g-67bs
3
url VCID-yfuu-th6b-nba4
vulnerability_id VCID-yfuu-th6b-nba4
summary 
Cross-site Scripting
Form field validation message XSS vulnerability.
references
0
reference_url https://www.silverstripe.org/download/security-releases/ss-2015-026/
reference_id
reference_type
scores
url https://www.silverstripe.org/download/security-releases/ss-2015-026/
fixed_packages
0
url pkg:composer/silverstripe/framework@3.2.1
purl pkg:composer/silverstripe/framework@3.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.1
aliases SS-2015-026-1
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-yfuu-th6b-nba4
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@3.2.1