Search for packages
| purl | pkg:composer/silverstripe/framework@3.3.0-alpha |
| Tags | Ghost |
| Next non-vulnerable version | 5.3.23 |
| Latest non-vulnerable version | 6.0.0-alpha1 |
| Risk |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-6j2p-tzvx-9bdj
Aliases: SS-2016-006 |
Missing CSRF protection in login form `LoginForm` calls `disableSecurityToken()`, which causes a "shared host domain" vulnerability. |
Affected by 55 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 53 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-dgn7-zmwr-u3c6
Aliases: SS-2015-029 |
CSRF vulnerability in savetreenodes `savetreenode` action does not have sufficient CSRF protection, meaning that in some cases users with CMS access can be tricked into posting unspecified data into the CMS from external websites. |
Affected by 55 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 53 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-tuwu-cznx-jqdb
Aliases: SS-2016-001 |
XSS in CMSController BackURL A XSS risk exists in the returnURL parameter passed to CMSSecurity/success. An unvalidated url could cause the user to redirect to an unverified third party url outside of the site. |
Affected by 55 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 53 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-wazt-hn99-qkdk
Aliases: SS-2016-005 |
Brute force bypass on default admin Default Administrator accounts were not subject to the same brute force protection afforded to other Member accounts. Failed login counts were not logged for default admins resulting in unlimited attempts on the default admin username and password. |
Affected by 55 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 53 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-zgy5-8cgd-gqhm
Aliases: SS-2016-004 |
XSS in CMS Edit Page Due to a lack of parameter sanitisation a carefully crafted URL could be used to inject arbitrary HTML into the CMS Edit page. An attacker could create a URL and share it with a site administrator to perform an attack. |
Affected by 55 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 53 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||