CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-28661
https://notcve.org/view.php?id=CVE-2021-28661
Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass. El comprobador de permisos predeterminado de SilverStripe GraphQL Server (también se conoce como silverstripe/graphql) versiones 3.x hasta 3.4.1, no es heredado por la subclase query • https://github.com/silverstripe/silverstripe-graphql/releases https://www.silverstripe.org/download/security-releases/CVE-2021-28661 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-36150
https://notcve.org/view.php?id=CVE-2021-36150
SilverStripe Framework through 4.8.1 allows XSS. SilverStripe Framework versiones hasta 4.8.1, permite un ataque de tipo XSS • https://github.com/silverstripe/silverstripe-framework/releases https://www.silverstripe.org/download/security-releases/CVE-2021-36150 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-26136
https://notcve.org/view.php?id=CVE-2020-26136
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication. En SilverStripe versiones hasta 4.6.0-rc1, GraphQL no respecta MFA (multi-factor authentication) cuando se usa la autenticación básica • https://forum.silverstripe.org/c/releases https://www.silverstripe.org/blog/tag/release https://www.silverstripe.org/download/security-releases https://www.silverstripe.org/download/security-releases/cve-2020-26136 • CWE-287: Improper Authentication •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25817
https://notcve.org/view.php?id=CVE-2020-25817
SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving external or user submitted data in custom project code, it can lead to vulnerabilities such as XSS on HTML output rendered through this custom code. This is now mitigated by disabling external entities during parsing. (The correct CVE ID year is 2020 [CVE-2020-25817, not CVE-2021-25817]). • https://forum.silverstripe.org/c/releases https://www.silverstripe.org/blog/tag/release https://www.silverstripe.org/download/security-releases https://www.silverstripe.org/download/security-releases/cve-2020-25817 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2020-26138
https://notcve.org/view.php?id=CVE-2020-26138
In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation. En SilverStripe versiones hasta 4.6.0-rc1, un FormField con corchetes en el nombre del campo omite la comprobación • https://forum.silverstripe.org/c/releases https://www.silverstripe.org/blog/tag/release https://www.silverstripe.org/download/security-releases https://www.silverstripe.org/download/security-releases/cve-2020-26138 • CWE-20: Improper Input Validation •