october/system Security Advisories (13)
-
[MEDIUM] October CMS stored XSS by authenticated backend user with improper configuration
PKSA-nq4f-mpv2-n3ph CVE-2023-44383 GHSA-rvx8-p3xp-fj3p
Affected version: >=3.0.0,<3.5.2
Reported by:
GitHub -
[MEDIUM] October CMS safe mode bypass using Twig sandbox escape
PKSA-mp4c-pdx9-4t88 CVE-2023-44382 GHSA-p8q3-h652-65vx
Affected version: >=3.0.0,<3.4.15
Reported by:
GitHub -
[MEDIUM] October CMS safe mode bypass using Page template injection
PKSA-h48h-31f5-knv7 CVE-2023-44381 GHSA-q22j-5r3g-9hmh
Affected version: >=3.0.0,<3.4.15
Reported by:
GitHub -
[HIGH] October CMS Safe Mode bypass leads to authenticated Remote Code Execution
PKSA-91zd-f7p3-qtvm CVE-2022-35944 GHSA-x4q7-m6fp-4v9v
Affected version: >=2.0.0,<2.2.34|>=3.0.0,<3.0.66
Reported by:
GitHub -
[HIGH] October CMS upload process vulnerable to RCE via Race Condition
PKSA-yr75-7y9f-cxw9 CVE-2022-24800 GHSA-8v7h-cpc2-r8jp
Affected version: >=2.0.0,<2.2.15|>=1.1.0,<1.1.12|<1.0.476
Reported by:
GitHub -
[MEDIUM] Missing server signature validation in OctoberCMS
PKSA-9y13-4h42-rz75 CVE-2022-23655 GHSA-53m6-44rc-h2q5
Affected version: <1.0.475|>=1.1.0,<1.1.11
Reported by:
GitHub -
[HIGH] Authenticated remote code execution in October CMS
PKSA-zpmz-wj2m-t91q CVE-2022-21705 GHSA-79jw-2f46-wv22
Affected version: >=2.0.0,<2.1.27|>=1.1.0,<1.1.10|<1.0.474
Reported by:
GitHub -
[HIGH] october/system arbitrary code execution
PKSA-v82s-kwcn-dh7q CVE-2021-32650 GHSA-5hfj-r725-wpc4
Affected version: <1.0.473|>=1.1.0,<1.1.6
Reported by:
GitHub -
[HIGH] October/System authenticated file write leads to remote code execution
PKSA-m6wq-j1hd-zj67 CVE-2021-32649 GHSA-wv23-pfj7-2mjj
Affected version: <1.0.473|>=1.1.0,<1.1.6
Reported by:
GitHub -
[HIGH] Deleted Admin Can Sign In to Admin Interface
PKSA-ygz3-dmrq-fzm6 CVE-2021-41126 GHSA-6gjf-7w99-j7x7
Affected version: >=2.1.0,<2.1.12
Reported by:
GitHub -
[HIGH] October CMS auth bypass and account takeover
PKSA-5jr1-315n-phgp CVE-2021-29487 GHSA-h76r-vgf3-j6w5
Affected version: >=1.1.1,<1.1.5|<1.0.472
Reported by:
GitHub -
[HIGH] Account Takeover in Octobercms
PKSA-s6tk-gzy5-p91g CVE-2021-32648 GHSA-mxr5-mc97-63rc
Affected version: >=1.1.1,<1.1.5|<1.0.472
Reported by:
GitHub -
[MEDIUM] Use of insecure jQuery version in OctoberCMS
PKSA-xy3n-kyy6-rp8s GHSA-v73w-r9xg-7cr9
Affected version: >=1.0.319,<1.0.466
Reported by:
GitHub