omeka

Records11All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

omeka records in CISA KEV

No omeka vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Omeka 6 records MEDIUM Omeka S 5 records HIGH

Records

11 records

TI-2023-03848 CVE-2023-4159 · GHSA-7w47-jrjm-5gw5

Unrestricted Upload of File with Dangerous Type in omeka/omeka-s

HIGH 73

Unrestricted Upload of File with Dangerous Type in GitHub repository omeka/omeka-s prior to 4.0.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00995 Published 2023-08-04 Fixed in 4.0.3 CWE-434

TI-2023-04206 CVE-2023-4560 · GHSA-qxg7-q87p-pgh2

Improper Authorization of Index Containing Sensitive Information in omeka/omeka-s

MEDIUM 62

Improper Authorization of Index Containing Sensitive Information in GitHub repository omeka/omeka-s prior to 4.0.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00715 Published 2023-08-28 Fixed in 4.0.4 CWE-612

TI-2023-03847 CVE-2023-4158 · GHSA-rjvg-3mg4-xmj6

Cross-site Scripting (XSS) - Stored in omeka/omeka-s

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00465 Published 2023-08-04 Fixed in 4.0.3 CWE-79

TI-2023-03846 CVE-2023-4157 · GHSA-fxc5-pr68-2px3

Improper Neutralization of Special Elements in Output Used by a Downstream Component in omeka/omeka-s

MEDIUM 57

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitHub repository omeka/omeka-s prior to version 4.0.3.

CVSS 3.1MEDIUM 5.2 Network High privileges User interaction EPSS 0.00514 Published 2023-08-04 Fixed in 4.0.3 CWE-74

TI-2023-03696 CVE-2023-3981 · GHSA-g7wc-6rh5-cx62

Server-Side Request Forgery (SSRF) in omeka/omeka-s

MEDIUM 56

Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0068 Published 2023-07-27 Fixed in 4.0.2 CWE-918

TI-2023-04207 CVE-2023-4561 · GHSA-j7q9-xpf4-q24f

Cross-site Scripting (XSS) - Stored in omeka/omeka-s

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.4.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00523 Published 2023-08-28 Fixed in 4.0.4 CWE-79

TI-2023-03697 CVE-2023-3982 · GHSA-8pv7-5xq4-wmx9

Cross-site Scripting (XSS) - Stored in omeka/omeka-s

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00463 Published 2023-07-27 Fixed in 4.0.2 CWE-79

TI-2023-03695 CVE-2023-3980 · GHSA-rf79-4hq7-3p9q

Cross-site Scripting (XSS) - Stored in omeka/omeka-s

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00463 Published 2023-07-27 Fixed in 4.0.2 CWE-79

TI-2014-04171 CVE-2014-5100 · GHSA-7559-3vv2-j6vq

Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow…

LOW 35

Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to a…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02466 Published 2014-07-25 No fix listed CWE-352

TI-2021-08438 CVE-2021-26799 · GHSA-p9cm-p38f-27vm

Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7…

LOW 29

Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7 allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01042 Published 2021-07-23 No fix listed CWE-79

TI-2018-09658 CVE-2018-13423 · GHSA-cvhf-p4w4-g3gm

admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag.

LOW 29

admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00886 Published 2018-07-07 No fix listed CWE-79

Open these records in search →