Rangerstudio Directus
11 CVEs affecting Rangerstudio Directus. Latest disclosed: 2023-03-06. Critical: 1, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-10723 | Critical | 9.8 | 2018-05-05 | Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql. |
CVE-2022-24814 | High | 8.8 | 2022-04-04 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be executed by insert… |
CVE-2021-29641 | High | 8.8 | 2021-04-07 | Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file t… |
CVE-2021-26594 | High | 8.8 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any control by the back end. NOTE: This vulnerab… |
CVE-2023-27474 | High | 8.0 | 2023-03-06 | Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed reset URL are vulnerable to an HTML injec… |
CVE-2021-26593 | High | 7.5 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. For each call, they get in response a lot of information abo… |
CVE-2022-22117 | Medium | 5.4 | 2022-01-10 | In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Sc… |
CVE-2022-22116 | Medium | 5.4 | 2022-01-10 | In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functio… |
CVE-2021-27583 | Medium | 5.3 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can discover whether a user is present in the database through the password reset feature. NOTE: This vulnerability… |
CVE-2021-26595 | Medium | 5.3 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of th… |
CVE-2022-23080 | Medium | 5.0 | 2022-06-22 | In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low priv… |