CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28104 – silverstripe/graphql Denial of Service vulnerability
https://notcve.org/view.php?id=CVE-2023-28104
16 Mar 2023 — `silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with particularly large/complex graphql schemas. Users should upgrade to `silverstripe/graphql` 4.2.3 or 4.1.2 to remedy the vulnerability. • https://github.com/silverstripe/silverstripe-graphql/pull/526 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-42949
https://notcve.org/view.php?id=CVE-2022-42949
20 Dec 2022 — Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions. Silverstripe silverstripe/subsites hasta 2.6.0 tiene permisos inseguros. • https://www.silverstripe.org/download/security-releases • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37421
https://notcve.org/view.php?id=CVE-2022-37421
23 Nov 2022 — Silverstripe silverstripe/cms through 4.11.0 allows XSS. El cms de Silverstripe hasta 4.11.0 permite XSS. • https://forum.silverstripe.org/c/releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37429
https://notcve.org/view.php?id=CVE-2022-37429
23 Nov 2022 — Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters. El framework Silverstripe hasta la versión 4.11 permite XSS (problema 1 de 2) a través del payload de JavaScript al atributo href de un enlace al dividir una URL de JavaScript con caracteres de espacio en blanco. • https://forum.silverstripe.org/c/releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37430
https://notcve.org/view.php?id=CVE-2022-37430
23 Nov 2022 — Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2). El framework Silverstripe hasta la versión 4.11 permite la vulnerabilidad XSS a través del atributo href de un enlace (problema 2 de 2). • https://forum.silverstripe.org/c/releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38145
https://notcve.org/view.php?id=CVE-2022-38145
23 Nov 2022 — Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view. El framework Silverstripe hasta la versión 4.11 permite XSS (problema 1 de 3) a través de atacantes remotos que agreguen un payload de Javascript a la meta descripción de una página y la ejecute en la vista de comparación del historial de versiones. • https://forum.silverstripe.org/c/releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38147
https://notcve.org/view.php?id=CVE-2022-38147
23 Nov 2022 — Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3). El framework Silverstripe hasta 4.11 permite XSS (problema 3 de 3). • https://forum.silverstripe.org/c/releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2022-38462
https://notcve.org/view.php?id=CVE-2022-38462
22 Nov 2022 — Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request. Silverstripe silverstripe/framework hasta 4.11 es vulnerable a XSS al manipular cuidadosamente una URL de retorno en una solicitud /dev/build o /Security/login. • https://forum.silverstripe.org/c/releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2022-38724
https://notcve.org/view.php?id=CVE-2022-38724
22 Nov 2022 — Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS. Silverstripe silverstripe/framework hasta 4.11.0, silverstripe/assets hasta 1.11.0 y silverstripe/asset-admin hasta 1.11.0 permiten XSS. • https://forum.silverstripe.org/c/releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38146
https://notcve.org/view.php?id=CVE-2022-38146
21 Nov 2022 — Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3). Silverstripe silverstripe/framework hasta 4.11 permite XSS (problema 2 de 3). • https://forum.silverstripe.org/c/releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •