CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-47194
https://notcve.org/view.php?id=CVE-2022-47194
19 Jan 2023 — An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `twitter` field for a user. • https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-453: Insecure Default Variable Initialization CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-41697
https://notcve.org/view.php?id=CVE-2022-41697
22 Dec 2022 — A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability. • https://talosintelligence.com/vulnerability_reports/TALOS-2022-1625 • CWE-204: Observable Response Discrepancy •
CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 1CVE-2022-41654
https://notcve.org/view.php?id=CVE-2022-41654
22 Dec 2022 — An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability. • https://github.com/TryGhost/Ghost/security/advisories/GHSA-9gh8-wp53-ccc6 • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2022-28397
https://notcve.org/view.php?id=CVE-2022-28397
12 Apr 2022 — An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional ** EN DISPUTA ** Una vulnerabilidad de carga de archivos arbitraria en el módulo de carga de archivos de Ghost CMS versión v4.42.0, permite a atacantes ejecutar código arbitrario por medio de un archivo diseñado. NOTA... • http://ghost.com • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-27139
https://notcve.org/view.php?id=CVE-2022-27139
12 Apr 2022 — An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploading of SVG files to Ghost does not represent a remote code execution vulnerability. SVGs are not executable on the server, and may only execute javascript in a client's browser - this is expected and intentional funct... • http://ghost.org/docs/security/#privilege-escalation-attacks • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-39192 – Privilege escalation: all users can access Admin-level API keys
https://notcve.org/view.php?id=CVE-2021-39192
03 Sep 2021 — Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability. This issue is patched in Ghost version 4.10.0. As a workaround, disable all non-Administrator accounts to prevent API access. It is highly recommended to regenerate all API keys after patching or applying the wo... • https://github.com/TryGhost/Ghost/releases/tag/v4.10.0 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-269: Improper Privilege Management •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-29484 – DOM XSS in Theme Preview
https://notcve.org/view.php?id=CVE-2021-29484
29 Apr 2021 — Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. Ghost(Pro) has already been patched. • https://blog.sonarsource.com/ghost-admin-takeover • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-8134
https://notcve.org/view.php?id=CVE-2020-8134
20 Mar 2020 — Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems. Una vulnerabilidad de tipo Server-side request forgery (SSRF) en Ghost CMS versiones anteriores a 3.10.0, permite a un atacante escanear redes locales o externas o si no interactuar con sistemas internos. • https://hackerone.com/reports/793704 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2016-10983 – Ghost <= 0.5.5 - Missing Authorization Checks
https://notcve.org/view.php?id=CVE-2016-10983
28 Apr 2016 — The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data. El plugin ghost versiones anteriores a 0.5.6 para WordPress, no posee un control de acceso para descargas de datos exportados de wp-admin/tools.php?ghostexport=true . The Ghost plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp-admin/tools.php? • https://packetstormsecurity.com/files/136887 • CWE-287: Improper Authentication CWE-862: Missing Authorization •