Search for packages
| purl | pkg:composer/silverstripe/framework@3.3.0-alpha |
| Tags | Ghost |
| Next non-vulnerable version | 5.3.23 |
| Latest non-vulnerable version | 6.0.0-alpha1 |
| Risk |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-6e1y-7jj8-a7cw
Aliases: SS-2016-004 |
XSS in CMS Edit Page Due to a lack of parameter sanitisation a carefully crafted URL could be used to inject arbitrary HTML into the CMS Edit page. An attacker could create a URL and share it with a site administrator to perform an attack. |
Affected by 55 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 53 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-7me4-ggep-sbhj
Aliases: SS-2016-006 |
Missing CSRF protection in login form `LoginForm` calls `disableSecurityToken()`, which causes a "shared host domain" vulnerability. |
Affected by 55 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 53 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-km94-727n-nfa6
Aliases: SS-2015-029 |
CSRF vulnerability in savetreenodes `savetreenode` action does not have sufficient CSRF protection, meaning that in some cases users with CMS access can be tricked into posting unspecified data into the CMS from external websites. |
Affected by 55 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 53 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-ku6h-zhz1-8ydr
Aliases: SS-2016-005 |
Brute force bypass on default admin Default Administrator accounts were not subject to the same brute force protection afforded to other Member accounts. Failed login counts were not logged for default admins resulting in unlimited attempts on the default admin username and password. |
Affected by 55 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 53 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-ud6e-smr7-vffw
Aliases: SS-2016-001 |
XSS in CMSController BackURL A XSS risk exists in the returnURL parameter passed to CMSSecurity/success. An unvalidated url could cause the user to redirect to an unverified third party url outside of the site. |
Affected by 55 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 53 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||