Vulnerabilities

TI-2020-17935 CVE-2020-35305 · GHSA-fj2w-qmjp-3rjm

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.

LOW 29

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0079 Published 2022-07-15 Fixed in 5.1.2 CWE-79

TI-2014-07713 CVE-2014-9489 · GHSA-q97v-764g-r2rp

The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem…

MEDIUM 43

The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string "master" is in any of the wiki documents, allows remote authenticated users…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02941 Published 2017-10-17 Fixed in 3.1.1, 4.0.1 CWE-284

TI-2015-06082 CVE-2015-7314 · GHSA-m2q3-53fq-7h66

The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary…

LOW 24

The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01876 Published 2015-10-03 Fixed in 4.0.1 CWE-200

Vulnerabilities

Filters

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.

The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem…

The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary…