Vendors / Rangerstudio Records 17 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 8
Exploited now Rangerstudio records in CISA KEV No Rangerstudio vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 45
Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01462 · Published 2019-07-19 · No fix listed CWE-306
Priority MEDIUM 43
In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/_/originals remote code execution with nginx.
CVSS 3.0 HIGH 8.8· Network · No auth · User interaction · EPSS 0.0245 · Published 2019-07-19 · No fix listed CWE-434
Priority MEDIUM 43
In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution.
CVSS 3.0 HIGH 8.8· Network · No auth · User interaction · EPSS 0.02577 · Published 2019-07-19 · No fix listed CWE-434
Priority MEDIUM 41
Directus 7 API before 2.3.0 does not validate uploaded files.
CVSS 3.0 HIGH 8.8· Network · No auth · User interaction · EPSS 0.01608 · Published 2019-07-19 · No fix listed CWE-434
Priority LOW 27
In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory.
CVSS 3.0 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.015 · Published 2019-07-19 · No fix listed CWE-425
Open these records in search → All records by CVSS severity
2 8 7 0 0
THREATIST.IORead the docs