Search for packages
| purl | pkg:composer/silverstripe/assets@1.11.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-ftdr-uzuh-8ybc | Silverstripe XSS in shortcodes A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used to inject a JavaScript payload on the front end of the site. The shortcode providers that ship with Silverstripe CMS have been reviewed and attribute whitelists have been implemented where appropriate to negate this risk. |
CVE-2022-38724
GHSA-9cx2-hj6m-fv58 GMS-2022-6853 GMS-2022-6856 |
| VCID-mhey-g1u8-wbbv | XSS via uploaded gpx file A malicious content author could upload a GPX file with a Javascript payload. The payload could then be executed by luring a legitimate user to view the file in a browser with support for GPX files. GPX is an XML-based format used to store GPS data. By default, Silverstripe CMS will no longer allow GPX files to be uploaded to the assets area. |
CVE-2022-38147
GHSA-vv3r-fxqp-vr3f GMS-2022-6854 |