Vulnerabilities > Silverstripe > Silverstripe > 4.2.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-11-23 | CVE-2022-37421 | Cross-site Scripting vulnerability in Silverstripe Silverstripe silverstripe/cms through 4.11.0 allows XSS. | 5.4 |
| 2022-06-29 | CVE-2022-28803 | Cross-site Scripting vulnerability in Silverstripe In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR). | 3.5 |
| 2022-06-28 | CVE-2021-41559 | XML Entity Expansion vulnerability in Silverstripe Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document. | 6.5 |
| 2021-10-07 | CVE-2021-36150 | Cross-site Scripting vulnerability in Silverstripe SilverStripe Framework through 4.8.1 allows XSS. | 4.3 |
| 2021-06-08 | CVE-2020-26136 | Improper Authentication vulnerability in Silverstripe In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication. | 4.0 |
| 2021-06-08 | CVE-2020-25817 | XXE vulnerability in Silverstripe SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. | 3.5 |
| 2021-06-08 | CVE-2020-26138 | Improper Input Validation vulnerability in Silverstripe In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation. | 5.0 |
| 2020-07-15 | CVE-2020-6164 | Information Exposure vulnerability in Silverstripe In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. | 5.0 |
| 2020-07-15 | CVE-2019-19326 | HTTP Request Smuggling vulnerability in Silverstripe Silverstripe CMS sites through 4.4.4 which have opted into HTTP Cache Headers on responses served by the framework's HTTP layer can be vulnerable to web cache poisoning. | 4.3 |
| 2020-04-15 | CVE-2020-9280 | Unrestricted Upload of File with Dangerous Type vulnerability in Silverstripe In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. | 5.0 |