Read the docs

Diagrams

Records27All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

Diagrams records in CISA KEV

No Diagrams vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Drawio 27 records HIGH

Records

27 records

TI-2023-03691 CVE-2023-3975 · GHSA-v966-93rm-v9qx

OS Command Injection in jgraph/drawio

Priority HIGH 76

OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02348 Published 2023-07-27 Fixed in 21.5.0 CWE-78
TI-2023-03690 CVE-2023-3974 · GHSA-2j63-r66v-jwpq

OS Command Injection in jgraph/drawio

Priority HIGH 76

OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01242 Published 2023-07-27 Fixed in 21.4.0 CWE-78
TI-2023-03178 CVE-2023-3398 · GHSA-xgp9-53fc-q25j

Denial of Service in jgraph/drawio

Priority HIGH 72

Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00969 Published 2023-06-26 Fixed in 18.1.3 CWE-400
TI-2023-02834 CVE-2023-3026 · GHSA-532w-w73j-36pf

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Priority HIGH 66

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00534 Published 2023-06-01 Fixed in 21.2.8 CWE-79
TI-2022-03550 CVE-2022-3873 · GHSA-whmf-vjx7-5wmv

Cross-site Scripting (XSS) - DOM in jgraph/drawio

Priority HIGH 66

Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00912 Published 2022-11-07 Fixed in 20.5.2 CWE-79
TI-2022-01579 CVE-2022-1713 · GHSA-5f4w-gff5-9w6x

SSRF on /proxy in jgraph/drawio

Priority MEDIUM 45

SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09581 Published 2022-05-16 Fixed in 18.0.4 CWE-918
TI-2022-01577 CVE-2022-1711 · GHSA-c9xr-h75p-wmh5

Server-Side Request Forgery (SSRF) in jgraph/drawio

Priority MEDIUM 42

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05795 Published 2022-05-17 Fixed in 18.0.5 CWE-918
TI-2022-01593 CVE-2022-1727 · GHSA-v54h-972g-3845

Improper Input Validation in jgraph/drawio

Priority MEDIUM 41

Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01407 Published 2022-05-18 Fixed in 18.0.6 CWE-20
TI-2022-01587 CVE-2022-1721 · GHSA-38xh-rw88-j2v8

Path Traversal in WellKnownServlet in jgraph/drawio

Priority LOW 37

Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02273 Published 2022-05-16 Fixed in 18.0.5 CWE-22
TI-2022-02892 CVE-2022-3133 · GHSA-gx3f-cvfm-x99m

OS Command Injection in jgraph/drawio

Priority LOW 36

OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01114 Published 2022-09-09 Fixed in 20.3.0 CWE-78
TI-2022-02827 CVE-2022-3065 · GHSA-fw5q-8v73-g7c4

Improper Access Control in jgraph/drawio

Priority LOW 36

Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0132 Published 2022-09-02 Fixed in 20.2.8 CWE-284
TI-2022-01650 CVE-2022-1784 · GHSA-mx52-g499-r9jm

Server-Side Request Forgery (SSRF) in jgraph/drawio

Priority LOW 36

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01798 Published 2022-05-20 Fixed in 18.0.8 CWE-918
TI-2022-01633 CVE-2022-1767 · GHSA-f4qm-wpp3-7v77

Server-Side Request Forgery (SSRF) in jgraph/drawio

Priority LOW 36

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0181 Published 2022-05-18 Fixed in 18.0.7 CWE-918
TI-2022-01589 CVE-2022-1723 · GHSA-vh6p-p447-hrrr

Server-Side Request Forgery (SSRF) in jgraph/drawio

Priority LOW 36

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01748 Published 2022-05-17 Fixed in 18.0.6 CWE-918
TI-2022-02978 CVE-2022-3223 · GHSA-qg6w-g8vm-cccf

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Priority LOW 29

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00797 Published 2022-09-16 Fixed in 20.3.1 CWE-79
TI-2022-02907 CVE-2022-3148 · GHSA-8m5x-34vp-mpvw

Cross-site Scripting (XSS) - Generic in jgraph/drawio

Priority LOW 28

Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2022-09-08 Fixed in 20.3.0 CWE-79
TI-2022-02897 CVE-2022-3138 · GHSA-ch99-86q2-42rq

Cross-site Scripting (XSS) - Generic in jgraph/drawio

Priority LOW 28

Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2022-09-08 Fixed in 20.3.0 CWE-79
TI-2022-01867 CVE-2022-2014 · GHSA-395p-gq7g-6x8g

Code Injection in jgraph/drawio

Priority LOW 26

Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00745 Published 2022-06-08 Fixed in 19.0.2 CWE-94
TI-2022-02886 CVE-2022-3127 · GHSA-r26w-7ccx-35wx

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Priority LOW 25

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00646 Published 2022-09-05 Fixed in 20.2.8 CWE-79
TI-2022-01868 CVE-2022-2015 · GHSA-6gph-p9m6-46vx

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Priority LOW 25

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00649 Published 2022-06-08 Fixed in 19.0.2 CWE-79
Load more
Open these records in search →