Search for packages
| purl | pkg:composer/mautic/core@2.14.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1unf-fcpb-t7gr
Aliases: CVE-2020-35129 GHSA-3px5-wjh3-9x6r |
Cross-site Scripting Mautic is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account. |
Affected by 1 other vulnerability. |
|
VCID-9tjy-3czw-37as
Aliases: CVE-2020-35124 GHSA-39wj-j3jc-858m |
Cross-site Scripting A cross-site scripting (XSS) vulnerability in the assets component of Mautic allows remote attackers to inject executable JavaScript through the Referer header of asset downloads. |
Affected by 3 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-dh9y-k8zb-zkew
Aliases: CVE-2020-35125 GHSA-42q7-95j7-w62m |
Cross-site Scripting A cross-site scripting (XSS) vulnerability in the forms component of Mautic allows remote attackers to inject executable JavaScript via mautic[return] (a different attack method than CVE-2020-35124, but also related to the Referer concept). |
Affected by 3 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-ghuh-z1uh-mbf5
Aliases: CVE-2021-27908 GHSA-4hjq-422q-4vpx |
Incorrect Permission Assignment for Critical Resource Secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application. |
Affected by 0 other vulnerabilities. |
|
VCID-j624-5zx3-c7c8
Aliases: CVE-2021-3142 GHSA-p7v4-gm6j-cw9m |
XSS in Mautic ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-35128. Reason: This candidate is a reservation duplicate of CVE-2020-35128. Notes: All CVE users should reference CVE-2020-35128 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. |
Affected by 3 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-p9jy-6mbb-ukad
Aliases: CVE-2020-35128 GHSA-98j2-3jv7-274m |
Cross-site Scripting Mautic is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a new administrator to the system. |
Affected by 3 other vulnerabilities. Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-4kqw-y2ds-eue2 | Cross-site Scripting Mautic contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code. |
CVE-2017-1000506
GHSA-358v-cqjc-2pcq |