Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
keystonejs keystone vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2023-40027
Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL query is publicly accessible (no session required). This is different to the behaviour of the default AdminUI middlew...
Keystonejs Keystone
NA
CVE-2023-34247
Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect leading `/` filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be u...
Keystonejs Keystone
NA
CVE-2022-39382
Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/core@3.0.0 || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive functionality in their production builds are vulnerable to `NODE_ENV` being inlined to `"development"` f...
Keystonejs Keystone 3.0.0
Keystonejs Keystone 3.0.1
NA
CVE-2022-39322
@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their `multiselect` fields to use the field-level access control - if configured - are vulnerable to their field-...
Keystonejs Keystone
668
VMScore
CVE-2022-29354
An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows malicious users to execute arbitrary code via a crafted file.
Keystonejs Keystone 4.2.1
383
VMScore
CVE-2022-0087
keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Keystonejs Keystone
312
VMScore
CVE-2021-32624
Keystone 5 is an open source CMS platform to build Node.js applications. This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access control. This is an ...
Keystonejs Keystone-5
445
VMScore
CVE-2015-9240
Due to a bug in the the default sign in functionality in the keystone node module prior to 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.
Keystonejs Keystone
685
VMScore
CVE-2017-16570
KeystoneJS prior to 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.
Keystonejs Keystone
1 EDB exploit
312
VMScore
CVE-2017-15881
Cross-Site Scripting vulnerability in KeystoneJS prior to 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the "content brief" or "content extended" field, a different vulnerability than CVE-2017-15878.
Keystonejs Keystone
Keystonejs Keystone 4.0.0
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
denial of service
CVE-2024-27371
CVE-2024-20405
CVE-2024-31627
CVE-2024-31625
race condition
CVE-2024-4358
cross-site scripting
CVE-2023-20938
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »