Skip to content
Noroxi

rangerstudio records

17 published records for vendor rangerstudio.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
17.6%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 21
  4. 22
  5. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

17 records
  • CVE-2019-13983
    39Monitor

    Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php

    CriticalCVSS 9.8No exploitEPSS 1%

    rangerstudio · directus 7 apiJul 19, 2019

  • CVE-2018-10723
    39Monitor

    Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql.

    CriticalCVSS 9.8No exploitEPSS 1%

    rangerstudio · directusMay 5, 2018

  • CVE-2021-29641
    36Monitor

    Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to u

    HighCVSS 8.8No exploitEPSS 4%

    rangerstudio · directusApr 7, 2021

  • CVE-2019-13979
    36Monitor

    In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution.

    HighCVSS 8.8No exploitEPSS 2%

    rangerstudio · directus 7 apiJul 19, 2019

  • CVE-2019-13980
    36Monitor

    In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/_/originals

    HighCVSS 8.8No exploitEPSS 2%

    rangerstudio · directus 7 apiJul 19, 2019

  • CVE-2019-13984
    35Monitor

    Directus 7 API before 2.3.0 does not validate uploaded files.

    HighCVSS 8.8No exploitEPSS 1%

    rangerstudio · directus 7 apiJul 19, 2019

  • CVE-2021-26594
    35Monitor

    In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any control by the back end.

    HighCVSS 8.8No exploitEPSS 1%

    rangerstudio · directusFeb 23, 2021

  • CVE-2021-26593
    30Monitor

    In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}.

    HighCVSS 7.5No exploitEPSS 1%

    rangerstudio · directusFeb 23, 2021

  • CVE-2022-24814
    24Monitor

    Cross-site Scripting in Directus

    MediumCVSS 6.1No exploitEPSS 1%

    rangerstudio · directusApr 4, 2022

  • CVE-2019-13981
    21Monitor

    In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ di

    MediumCVSS 5.3No exploitEPSS 1%

    rangerstudio · directus 7 apiJul 19, 2019

  • CVE-2019-13982
    21Monitor

    interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview.

    MediumCVSS 5.3No exploitEPSS 1%

    rangerstudio · directus 7Jul 19, 2019

  • CVE-2021-27583
    21Monitor

    In Directus 8.x through 8.8.1, an attacker can discover whether a user is present in the database through the password reset feature.

    MediumCVSS 5.3No exploitEPSS 1%

    rangerstudio · directusFeb 23, 2021

  • CVE-2021-26595
    21Monitor

    In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site,

    MediumCVSS 5.3No exploitEPSS 0%

    rangerstudio · directusFeb 23, 2021

  • CVE-2022-22116
    21Monitor

    Directus - Stored Cross-Site Scripting (XSS) via SVG File Upload

    MediumCVSS 5.4No exploitEPSS 0%

    rangerstudio · directusJan 10, 2022

  • CVE-2022-22117
    21Monitor

    Directus - Stored Cross-Site Scripting (XSS) in Profile Avatar Image

    MediumCVSS 5.4No exploitEPSS 0%

    rangerstudio · directusJan 10, 2022

  • CVE-2023-27474
    21Monitor

    HTML Injection in Password Reset email to custom Reset URL in directus

    MediumCVSS 5.4No exploitEPSS 0%

    rangerstudio · directusMar 6, 2023

  • CVE-2022-23080
    20Monitor

    directus - SSRF which leads to internal port scan

    MediumCVSS 5.0No exploitEPSS 0%

    rangerstudio · directusJun 22, 2022