Known vulnerabilities in strapi - page 2

Vendor: strapi.io
Software: strapi
Software CPE: cpe:2.3:a:strapi.io:strapi:*:*:*:*:*:*:*:*
Website: https://strapi.io/
Total vulnerabilities: 37
Public exploits: 8
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting strapi strapi is affected by 37 known vulnerabilities: 11 high, 14 medium, 12 low Critical High Medium Low

Vulnerabilities (37)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU75700 - Improper Authentication
CVE-2023-22893		 CWE-287 High
No
No
 4.6.0 03.05.2023 SB2023050328
#VU75699 - Exposure of sensitive information to an unauthorized actor
CVE-2023-22894		 CWE-200 Medium
Available
No
 4.8.0 03.05.2023 SB2023050327
#VU71658 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2016-20018		 CWE-89 High
No
No
 4.6.0 30.01.2023 SB2023013043
SB2023013044
#VU71185 - Improper input validation
CVE-2022-23529		 CWE-20 High
Available
No
 4.5.6 16.01.2023 SB2023011632
SB2023011633
SB2023020132
and 12 more
#VU71182 - Use of a Broken or Risky Cryptographic Algorithm
CVE-2022-23540		 CWE-327 High
Available
No
 4.5.6 16.01.2023 SB2023011632
SB2023011633
SB2023020322
and 15 more
#VU71181 - Use of a Broken or Risky Cryptographic Algorithm
CVE-2022-23541		 CWE-327 High
No
No
 4.5.6 16.01.2023 SB2023011632
SB2023011633
SB2023020322
and 16 more
#VU71180 - Use of a Broken or Risky Cryptographic Algorithm
CVE-2022-23539		 CWE-327 Medium
No
No
 4.5.6 16.01.2023 SB2023011632
SB2023011633
SB2023020322
and 16 more
#VU69675 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-24999		 CWE-94 Medium
Available
No
 4.5.5 29.11.2022 SB2022112910
SB2022112911
SB2022112943
and 49 more
#VU66181 - Session Fixation
CVE-2022-25896		 CWE-384 Medium
No
No
 4.3.0 08.08.2022 SB2022080818
SB2022080819
SB2022110270
and 7 more
#VU63132 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-29894		 CWE-79 Low
No
No
 4.0.0 13.05.2022 SB2022051306
#VU47916 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-27666		 CWE-79 Low
No
No
 3.2.5 22.10.2020 SB2020102615
#VU47917 - Permissions, Privileges, and Access Controls
CVE-2020-27665		 CWE-264 High
No
No
 3.2.5 22.10.2020 SB2020102615
#VU47918 - Improper input validation
CVE-2020-27664		 CWE-20 Medium
No
No
 3.2.5 22.10.2020 SB2020102615
#VU34229 - Improper input validation
CVE-2020-13961		 CWE-20 Medium
No
No
 3.0.2 19.06.2020 SB2020061957
#VU24842 - Resource exhaustion
 CWE-400 Medium
No
No
 3.0.0 beta.18.4 03.02.2020 SB2020020312
#VU23442 - Improper input validation
CVE-2019-19609		 CWE-20 Medium
Available
No
 3.0.0 beta.17.8 06.12.2019 SB2019120606
#VU22788 - Weak password recovery mechanism
CVE-2019-18818		 CWE-640 High
Available
No
 3.0.0 beta.17.5 15.11.2019 SB2019111505


Showing elements 21 - 40 out of 37