VulnerableCode Package Details - pkg:composer/silverstripe/framework@3.3.0-alpha0

Search for packages

Advisory	Summary	Fixed in package version
SS-2016-010	ReadOnly transformation for formfields exploitable Form fields returning `isReadonly()` as true are vulnerable to reflected XSS injections. This includes `ReadonlyField`, …	3.4.2 Vulnerable 3.2.6 Vulnerable 3.1.21 Vulnerable 3.3.4 Vulnerable
SS-2016-007	VersionedRequestFilter vulnerability A cross-site scripting vulnerability in `VersionedRequestFilter` has been found. If an incoming user request should not be able …	3.3.3 Vulnerable 3.4.1 Vulnerable
SS-2016-014	Pre-existing alc_enc cookies log users in if remember me is disabled If remember me is on and users log in …	3.1.20 Vulnerable 3.2.5 Vulnerable 3.3.3 Vulnerable 3.4.1 Vulnerable
SS-2016-016	XSS In CMSSecurity BackURL In follow up to SS-2016-001 there is yet a minor unresolved fix to incorrectly encoded URL.	3.4.2 Vulnerable 3.2.6 Vulnerable 3.1.21 Vulnerable 3.3.4 Vulnerable
SS-2016-008	Password encryption salt expiry When a user changes their password, the internal salt used for hashing their password is not …	3.1.20 Vulnerable 3.2.5 Vulnerable 3.3.3 Vulnerable 3.4.1 Vulnerable
SS-2016-015	XSS In OptionsetField and CheckboxSetField List of key / value pairs assigned to `OptionsetField` or `CheckboxSetField` do not have a …	3.1.20 Vulnerable 3.2.5 Vulnerable 3.3.3 Vulnerable 3.4.1 Vulnerable
SS-2016-011	ChangePasswordForm doesn't check Member::canLogIn() After performing a password reset, `ChangePasswordForm::doChangePassword()` logs in the user without checking `Member::canLogIn()`. This presents an …	3.2.5 Vulnerable 3.3.3 Vulnerable
SS-2016-013	Member.Name isn't escaped The core template `framework/templates/Includes/GridField_print.ss` uses "Printed by $Member.Name". If the currently logged in members first name or …	3.1.20 Vulnerable 3.2.5 Vulnerable 3.3.3 Vulnerable 3.4.1 Vulnerable
SS-2016-012	Missing ACL on reports The `SS_Report`, and the reports CMS section only checks `canView()` when listing the reports that can …	3.1.20 Vulnerable 3.2.5 Vulnerable 3.3.3 Vulnerable 3.4.1 Vulnerable

Advisory

Summary

Fixed in package version

SS-2016-010

ReadOnly transformation for formfields exploitable Form fields returning `isReadonly()` as true are vulnerable to reflected XSS injections. This includes `ReadonlyField`, …

3.4.2
Vulnerable

3.2.6
Vulnerable

3.1.21
Vulnerable

3.3.4
Vulnerable

SS-2016-007

VersionedRequestFilter vulnerability A cross-site scripting vulnerability in `VersionedRequestFilter` has been found. If an incoming user request should not be able …

3.3.3
Vulnerable

3.4.1
Vulnerable

SS-2016-014

Pre-existing alc_enc cookies log users in if remember me is disabled If remember me is on and users log in …

3.1.20
Vulnerable

3.2.5
Vulnerable

3.3.3
Vulnerable

3.4.1
Vulnerable

SS-2016-016

XSS In CMSSecurity BackURL In follow up to SS-2016-001 there is yet a minor unresolved fix to incorrectly encoded URL.

3.4.2
Vulnerable

3.2.6
Vulnerable

3.1.21
Vulnerable

3.3.4
Vulnerable

SS-2016-008

Password encryption salt expiry When a user changes their password, the internal salt used for hashing their password is not …

3.1.20
Vulnerable

3.2.5
Vulnerable

3.3.3
Vulnerable

3.4.1
Vulnerable

SS-2016-015

XSS In OptionsetField and CheckboxSetField List of key / value pairs assigned to `OptionsetField` or `CheckboxSetField` do not have a …

3.1.20
Vulnerable

3.2.5
Vulnerable

3.3.3
Vulnerable

3.4.1
Vulnerable

SS-2016-011

ChangePasswordForm doesn't check Member::canLogIn() After performing a password reset, `ChangePasswordForm::doChangePassword()` logs in the user without checking `Member::canLogIn()`. This presents an …

3.2.5
Vulnerable

3.3.3
Vulnerable

SS-2016-013

Member.Name isn't escaped The core template `framework/templates/Includes/GridField_print.ss` uses "Printed by $Member.Name". If the currently logged in members first name or …

3.1.20
Vulnerable

3.2.5
Vulnerable

3.3.3
Vulnerable

3.4.1
Vulnerable

SS-2016-012

Missing ACL on reports The `SS_Report`, and the reports CMS section only checks `canView()` when listing the reports that can …

3.1.20
Vulnerable

3.2.5
Vulnerable

3.3.3
Vulnerable

3.4.1
Vulnerable

purl	pkg:composer/silverstripe/framework@3.3.0-alpha0
Tags	Ghost

Next non-vulnerable version	6.2.2
Latest non-vulnerable version	6.2.2
Risk score