All vulnerabilties listed here are already fixed.
philip.media would like to thank the following security researchers, who have reported vulnerabilities to us as part of a Responsible Disclosure Procedure:
Researcher | Vulnerability | CVE | Risk level |
---|---|---|---|
Automated via Snyk Code | Path Traversal | CWE-23 | Low risk |
Automated via Snyk Code | Cross-site Scripting (XSS) | CWE-79 | Medium risk |
Jack Works via Dependabot | Cross-realm object access in Webpack 5 | CVE-2023-28154 | Medium risk |
Researcher | Vulnerability | CVE | Risk level |
---|---|---|---|
Parshwa Bhavsar | Unauthorized REST-API Access (WP) | CVE-2017-5487 | Medium risk |
Gaurang Maheta | Deprecated SSH Protocol (False positive) | CVE-2001-1473 | Low risk |
Dependabot | Cross-domain cookie leakage in Guzzle (guzzlehttp/guzzle) | CVE-2022-29248 | High risk |
Dependabot | Fix failure to strip Authorization header on HTTP downgrade in Guzzle (guzzlehttp/guzzle) | CVE-2022-31043 | Medium risk |
Dependabot | Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle (guzzlehttp/guzzle) | CVE-2022-31042 | Medium risk |
Dependabot | Change in port should be considered a change in origin in Guzzle (guzzlehttp/guzzle) | CVE-2022-31091 | Low risk |
Dependabot | CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle (guzzlehttp/guzzle) | CVE-2022-31090 | Medium risk |
Researcher | Vulnerability | CVE | Risk level |
---|---|---|---|
Intern (pb) | Log4Shell | CVE-2021-45105 | High risk |
Gaurang Maheta | OpenSSH Username Enumeration | Medium risk | |
Sivan Mujtaba | XSS Vulnerability | Low risk | |
ykl | XSS Vulnerability | Low risk | |
SECFAULT | iFrame injection | Medium risk |
Researcher | Vulnerability | CVE | Risk level |
---|---|---|---|
No name given | Database leakage | High risk |