Vulnerabilities

TI-2021-19748 CVE-2021-43996 · GHSA-vhrp-8qx4-vr6c

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix…

MEDIUM 46

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01725 Published 2021-11-17 Fixed in 1.16.15, 2.0.6 CWE-284

TI-2021-02221 CVE-2021-3129 · GHSA-4qwp-7c67-jmcc

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated…

CRITICAL 100KEV

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99943 Published 2021-01-12 Fixed in 2.5.2, 2.4.2 +2 CWE-94

TI-2020-10887 CVE-2020-13909 · GHSA-m5v7-pr32-mjx2

The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie…

MEDIUM 45

The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01516 Published 2020-06-07 Fixed in 2.0.5, 1.16.15

Vulnerabilities

Filters

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix…

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated…

The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie…