Priority MEDIUM 62
Improper Authorization of Index Containing Sensitive Information in GitHub repository omeka/omeka-s prior to 4.0.4.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00715 · Published 2023-08-28 · Fixed in 4.0.4 CWE-612
Priority MEDIUM 55
Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.4.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00523 · Published 2023-08-28 · Fixed in 4.0.4 CWE-79
Priority HIGH 73
Unrestricted Upload of File with Dangerous Type in GitHub repository omeka/omeka-s prior to 4.0.3.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2023-08-04 · Fixed in 4.0.3 CWE-434
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00465 · Published 2023-08-04 · Fixed in 4.0.3 CWE-79
Priority MEDIUM 57
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitHub repository omeka/omeka-s prior to version 4.0.3.
CVSS 3.1MEDIUM 5.2· Network · High privileges · User interaction · EPSS 0.00514 · Published 2023-08-04 · Fixed in 4.0.3 CWE-74
Priority MEDIUM 55
Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00463 · Published 2023-07-27 · Fixed in 4.0.2 CWE-79
Priority MEDIUM 56
Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.0068 · Published 2023-07-27 · Fixed in 4.0.2 CWE-918
Priority MEDIUM 55
Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00463 · Published 2023-07-27 · Fixed in 4.0.2 CWE-79
Priority LOW 29
Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7 allows remote attackers to inject arbitrary web script or HTML.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01042 · Published 2021-07-23 · No fix listed CWE-79
Priority LOW 29
admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00886 · Published 2018-07-07 · No fix listed CWE-79
Priority LOW 35
Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to a…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.02466 · Published 2014-07-25 · No fix listed CWE-352
THREATIST.IORead the docs