Skip to main content
cve.nowby Sazabi
← npm
npmPackage

keystone

5 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5
Registry
npm

Advisories 5

  • Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be…

    Affected: fixed in 0.3.16.

  • KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number…

    Affected: fixed in 4.0.0-beta.7.

  • Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web…

    Affected: fixed in 4.0.0-beta7.

  • CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in…

    Affected: fixed in 4.0.0-beta7.

  • A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the…

    Affected: fixed in 4.0.0.