Browse CVEs

MEDIUM 5.4 CVE-2023-27474 Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed reset URL are vulnerable to an … Directus 9.23.0+ Fix from $1,6002023-03-06 MEDIUM 5.0 CVE-2022-23080 In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows … Directus after 9.6.0 Fix from $1,6002022-06-22 MEDIUM 6.1 CVE-2022-24814 Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be executed… Directus 9.7.0+ Fix from $1,6002022-04-04 MEDIUM 5.4 CVE-2022-22116 In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media uplo… Directus after 9.4.1 Fix from $1,6002022-01-10 MEDIUM 5.4 CVE-2022-22117 In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cro… Directus after 9.4.1 Fix from $1,6002022-01-10 HIGH 8.8 CVE-2021-29641 Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .… Directus 8.8.2+ Fix from $1,9502021-04-07 MEDIUM 5.3 CVE-2021-27583 In Directus 8.x through 8.8.1, an attacker can discover whether a user is present in the database through the password reset feature. NOTE: This vuln… Directus after 8.8.1 Fix from $1,6002021-02-23 HIGH 8.8 CVE-2021-26594 In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any control by the back end. NOTE: Thi… Directus after 8.8.1 Fix from $1,9502021-02-23 HIGH 7.5 CVE-2021-26593 In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. For each call, they get in response a lot of infor… Directus after 8.8.1 Fix from $1,9502021-02-23 MEDIUM 5.3 CVE-2021-26595 In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the … Directus after 8.8.1 Fix from $1,6002021-02-23 CRITICAL 9.8 CVE-2019-13983 Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endp… Directus 7 Api 2.2.2+ Fix from $2,3002019-07-19 HIGH 8.8 CVE-2019-13979 In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution. Directus 7 Api 2.2.1+ Fix from $1,9502019-07-19 HIGH 8.8 CVE-2019-13980 In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/_/originals remote co… Directus 7 Api after 2.3.0 Fix from $1,9502019-07-19 HIGH 8.8 CVE-2019-13984 Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded … Directus 7 Api 2.3.0+ Fix from $1,9502019-07-19 MEDIUM 5.3 CVE-2019-13981 In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. … Directus 7 Api after 2.3.0 Fix from $1,6002019-07-19 MEDIUM 5.3 CVE-2019-13982 interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview. Directus 7 7.7.0+ Fix from $1,6002019-07-19 CRITICAL 9.8 CVE-2018-10723 Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql. Directus No fix yet Fix from $2,3002018-05-05