payload
Page établie d’après les avis qui citent ce paquet : ses métadonnées de registre (versions, licence, dépendances) n’ont pas encore été récupérées par ce service.
En bref
- Écosystème
- npm
- État de vulnérabilité
- 29 avis sans verdict
Avis (29)
| Avis | Versions affectées | Dernière version |
|---|---|---|
| GHSA-238x-w2j9-gwwr Payload vulnerable to API key disclosure through ordinary document reads | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-26rv-h2hf-3fw4 Payload's SQLite adapter Session Fixation vulnerability | < 3.44.0 | Indéterminé |
| GHSA-2g7p-5934-q4w7 Payload: ReDoS in Multipart Content-Type Validation | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-2pwp-2369-8fg3 Payload: Bypassed sanitization of user uploaded SVGs | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-35jj-vqcf-f2jf Hidden fields can be leaked on readable collections in Payload | < 1.7.0 | Indéterminé |
| GHSA-5v66-m237-hwf7 Payload does not invalidate JWTs after log out | < 3.44.0 | Indéterminé |
| GHSA-66wr-7vmr-p5jq Payload authentication token field handling issue | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-6r7f-q7f5-wpx8 Payload has Authenticated SSRF via Upload Functionality | < 3.79.1 | Indéterminé |
| GHSA-7c34-32v3-j575 Payload relationship-query authorization bypass | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-7xxh-373w-35vg Payload has an SQL Injection via Query Handling | < 3.79.1 | Indéterminé |
| GHSA-97rh-rhh2-7vjv Payload: Remote Code Execution through first-register | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-9g87-32v6-3c2r Payload: Sort queries could expose protected field information | < 3.88.0 ; 4.0.0-canary.0 – < 4.0.0-canary.27 | Indéterminé |
| GHSA-9qpg-3cf8-w33x Payload: Uploaded XML files could execute same-origin JavaScript | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-f7hx-52q9-hcrf Payload: Unauthorized update to collection documents | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-fpww-c55p-cjv6 Payload: Polymorphic join queries could disclose hidden fields | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-fx49-4h83-wjv9 Payload didn't enforce field-level password update restrictions | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-hhfx-5x8j-f5f6 Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads | < 3.75.0 | Indéterminé |
| GHSA-hp5w-3hxx-vmwf Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery | < 3.79.1 | Indéterminé |
| GHSA-jg8r-5jh2-v2xj Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts | ≤ 3.88.0 | Indéterminé |
| GHSA-jq29-r496-r955 payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) | < 3.74.0 | Indéterminé |
| GHSA-p223-2wr2-j562 Payload: Incomplete validation during the upload file lifecycle | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-p6mr-xf3r-ghq4 Payload has a CSRF Protection Bypass in Authentication Flow | < 3.79.1 | Indéterminé |
| GHSA-pj5h-5q6c-3pfx Payload external upload trust validation issue | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-q6mq-ch85-c8mm Payload: Password hashes use insufficient PBKDF2 iterations | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-v49j-62m6-pgrr Payload: SQL Injection in SQLite and Postgres | 3.0.0 – < 3.88.0 ; 4.0.0-canary.0 – < 4.0.0-canary.27 | Indéterminé |
| GHSA-v5gf-vpjc-pc7w Payload: Unauthenticated account-lockout denial of service | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
| GHSA-w84c-53h3-mc2g Payload: Untrusted redirect URL parameter exploit | 3.40.0 – < 3.88.0 ; 4.0.0-canary.0 – < 4.0.0-canary.27 | Indéterminé |
| GHSA-w8xh-93qh-35vw Unrestricted Upload of File with Dangerous Type in Payload | < 0.15.1 | Indéterminé |
| GHSA-xgv3-crq2-6f69 Payload: Token refresh and password reset responses may expose restricted user fields | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Indéterminé |
Sources
| Source | Licence |
|---|