Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

27 records

Vendor: Diagrams Component: Drawio Clear all filters
TI-2023-03691 CVE-2023-3975 · GHSA-v966-93rm-v9qx

OS Command Injection in jgraph/drawio

Priority HIGH 76

OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02348 Published 2023-07-27 Fixed in 21.5.0 CWE-78
TI-2023-03690 CVE-2023-3974 · GHSA-2j63-r66v-jwpq

OS Command Injection in jgraph/drawio

Priority HIGH 76

OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01242 Published 2023-07-27 Fixed in 21.4.0 CWE-78
TI-2023-03178 CVE-2023-3398 · GHSA-xgp9-53fc-q25j

Denial of Service in jgraph/drawio

Priority HIGH 72

Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00969 Published 2023-06-26 Fixed in 18.1.3 CWE-400
TI-2023-02834 CVE-2023-3026 · GHSA-532w-w73j-36pf

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Priority HIGH 66

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00534 Published 2023-06-01 Fixed in 21.2.8 CWE-79
TI-2022-03550 CVE-2022-3873 · GHSA-whmf-vjx7-5wmv

Cross-site Scripting (XSS) - DOM in jgraph/drawio

Priority HIGH 66

Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00912 Published 2022-11-07 Fixed in 20.5.2 CWE-79
TI-2022-02978 CVE-2022-3223 · GHSA-qg6w-g8vm-cccf

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Priority LOW 29

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00797 Published 2022-09-16 Fixed in 20.3.1 CWE-79
TI-2022-02892 CVE-2022-3133 · GHSA-gx3f-cvfm-x99m

OS Command Injection in jgraph/drawio

Priority LOW 36

OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01114 Published 2022-09-09 Fixed in 20.3.0 CWE-78
TI-2022-02897 CVE-2022-3138 · GHSA-ch99-86q2-42rq

Cross-site Scripting (XSS) - Generic in jgraph/drawio

Priority LOW 28

Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2022-09-08 Fixed in 20.3.0 CWE-79
TI-2022-02907 CVE-2022-3148 · GHSA-8m5x-34vp-mpvw

Cross-site Scripting (XSS) - Generic in jgraph/drawio

Priority LOW 28

Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2022-09-08 Fixed in 20.3.0 CWE-79
TI-2022-02886 CVE-2022-3127 · GHSA-r26w-7ccx-35wx

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Priority LOW 25

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00646 Published 2022-09-05 Fixed in 20.2.8 CWE-79
TI-2022-02827 CVE-2022-3065 · GHSA-fw5q-8v73-g7c4

Improper Access Control in jgraph/drawio

Priority LOW 36

Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0132 Published 2022-09-02 Fixed in 20.2.8 CWE-284
TI-2022-01868 CVE-2022-2015 · GHSA-6gph-p9m6-46vx

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Priority LOW 25

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00649 Published 2022-06-08 Fixed in 19.0.2 CWE-79
TI-2022-01867 CVE-2022-2014 · GHSA-395p-gq7g-6x8g

Code Injection in jgraph/drawio

Priority LOW 26

Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00745 Published 2022-06-08 Fixed in 19.0.2 CWE-94
TI-2022-01650 CVE-2022-1784 · GHSA-mx52-g499-r9jm

Server-Side Request Forgery (SSRF) in jgraph/drawio

Priority LOW 36

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01798 Published 2022-05-20 Fixed in 18.0.8 CWE-918
TI-2022-01596 CVE-2022-1730 · GHSA-p2vx-c68w-76w4

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Priority LOW 22

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00619 Published 2022-05-19 Fixed in 18.0.4 CWE-79
TI-2022-01633 CVE-2022-1767 · GHSA-f4qm-wpp3-7v77

Server-Side Request Forgery (SSRF) in jgraph/drawio

Priority LOW 36

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0181 Published 2022-05-18 Fixed in 18.0.7 CWE-918
TI-2022-01593 CVE-2022-1727 · GHSA-v54h-972g-3845

Improper Input Validation in jgraph/drawio

Priority MEDIUM 41

Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01407 Published 2022-05-18 Fixed in 18.0.6 CWE-20
TI-2022-01577 CVE-2022-1711 · GHSA-c9xr-h75p-wmh5

Server-Side Request Forgery (SSRF) in jgraph/drawio

Priority MEDIUM 42

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05795 Published 2022-05-17 Fixed in 18.0.5 CWE-918
TI-2022-01589 CVE-2022-1723 · GHSA-vh6p-p447-hrrr

Server-Side Request Forgery (SSRF) in jgraph/drawio

Priority LOW 36

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01748 Published 2022-05-17 Fixed in 18.0.6 CWE-918
TI-2022-01579 CVE-2022-1713 · GHSA-5f4w-gff5-9w6x

SSRF on /proxy in jgraph/drawio

Priority MEDIUM 45

SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09581 Published 2022-05-16 Fixed in 18.0.4 CWE-918
TI-2022-01587 CVE-2022-1721 · GHSA-38xh-rw88-j2v8

Path Traversal in WellKnownServlet in jgraph/drawio

Priority LOW 37

Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02273 Published 2022-05-16 Fixed in 18.0.5 CWE-22
Load more