Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-e5g9-xgrk-eqaf
Summary
Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode.
Aliases
0
alias CVE-2024-48927
1
alias GHSA-5955-cwv4-h7qh
Fixed_packages
0
url pkg:nuget/Umbraco.Cms@10.8.7
purl pkg:nuget/Umbraco.Cms@10.8.7
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.Cms@10.8.7
1
url pkg:nuget/Umbraco.Cms@13.5.2
purl pkg:nuget/Umbraco.Cms@13.5.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.Cms@13.5.2
2
url pkg:nuget/UmbracoCms@8.18.15
purl pkg:nuget/UmbracoCms@8.18.15
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/UmbracoCms@8.18.15
3
url pkg:nuget/Umbraco.CMS@10.8.7
purl pkg:nuget/Umbraco.CMS@10.8.7
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@10.8.7
4
url pkg:nuget/Umbraco.CMS@13.5.2
purl pkg:nuget/Umbraco.CMS@13.5.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@13.5.2
Affected_packages
0
url pkg:nuget/UmbracoCms@8.0.0
purl pkg:nuget/UmbracoCms@8.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1rkh-7s4e-vyen
1
vulnerability VCID-2cmy-5q87-5bgb
2
vulnerability VCID-2e5t-qrxu-6bhc
3
vulnerability VCID-6hye-45tx-auc9
4
vulnerability VCID-azpt-qmk7-1ueu
5
vulnerability VCID-e5g9-xgrk-eqaf
6
vulnerability VCID-ehsc-c1uh-tua1
7
vulnerability VCID-s3pr-pezb-4qf4
8
vulnerability VCID-wtw6-zcw6-2yd2
9
vulnerability VCID-xu9a-vwjv-5ycb
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/UmbracoCms@8.0.0
1
url pkg:nuget/Umbraco.CMS@10.0.0
purl pkg:nuget/Umbraco.CMS@10.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2exh-k5tm-r3cy
1
vulnerability VCID-e5g9-xgrk-eqaf
2
vulnerability VCID-nhwe-aq8z-ryhn
3
vulnerability VCID-yhat-ry32-fqf5
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@10.0.0
2
url pkg:nuget/Umbraco.CMS@13.0.0
purl pkg:nuget/Umbraco.CMS@13.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-e5g9-xgrk-eqaf
1
vulnerability VCID-yhat-ry32-fqf5
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@13.0.0
References
0
reference_url https://github.com/umbraco/Umbraco-CMS
reference_id
reference_type
scores
0
value 4.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/umbraco/Umbraco-CMS
1
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-48927
reference_id CVE-2024-48927
reference_type
scores
0
value 4.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-48927
2
reference_url https://github.com/advisories/GHSA-5955-cwv4-h7qh
reference_id GHSA-5955-cwv4-h7qh
reference_type
scores
url https://github.com/advisories/GHSA-5955-cwv4-h7qh
3
reference_url https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-5955-cwv4-h7qh
reference_id GHSA-5955-cwv4-h7qh
reference_type
scores
0
value 4.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-5955-cwv4-h7qh
Weaknesses
0
cwe_id 74
name Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
description The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-e5g9-xgrk-eqaf