apostrophe vulnerabilities (npm)
36 vulnerabilities.
-
apostrophenpm ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export 7.5 High -
apostrophenpm ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing 5.9 Medium -
apostrophenpm ApostropheCMS: Cross-domain session token in URL confers session takeover 5.3 Medium -
apostrophenpm ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) 5.3 Medium -
apostrophenpm ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service 7.1 High -
apostrophenpm ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints 3.7 Low -
apostrophenpm ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers 4.3 Medium -
apostrophenpm ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users 6.1 Medium -
apostrophenpm ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory 7.5 High -
apostrophenpm ApostropheCMS: Import API bypasses publication roles for protected content 6.5 Medium -
apostrophenpm ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization 4.3 Medium -
apostrophenpm ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) 6.9 Medium -
apostrophenpm ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization 5.4 Medium -
apostrophenpm ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users 4.3 Medium -
apostrophenpm ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API 5.3 Medium -
apostrophenpm ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user 4.3 Medium -
apostrophenpm ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix 5.4 Medium -
apostrophenpm ApostropheCMS: Page REST API authorization bypass 5.3 Medium -
apostrophenpm ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as... 5.3 Medium -
apostrophenpm ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS 7.1 High -
apostrophenpm ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree 6.5 Medium -
apostrophenpm Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass 9.1 Critical -
apostrophenpm @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header 3.7 Low -
apostrophenpm Apostrophe has stored XSS via javascript: URL in Image Widget Link 7.3 High -
apostrophenpm Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation 8.1 High -
apostrophenpm Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget 7.6 High -
apostrophenpm Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions 5.3 Medium -
apostrophenpm ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS 8.7 High -
apostrophenpm ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context 5.4 Medium -
apostrophenpm ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API 5.3 Medium -
apostrophenpm ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint 3.7 Low -
apostrophenpm ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware 8.1 High -
apostrophenpm Apostrophe - Insufficient Session Expiration 9.8 Critical -
apostrophenpm Apostrophe - XSS 5.4 Medium -
apostrophenpm Denial of Service in apostrophe No score -
apostrophenpm Open Redirect in apostrophe No score