Skip to content
OpenAdvisories

Package · RubyGems

publify_core

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

15 results · Feed

  • Low 1.8
    CVE-2024-39311

    Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction

    Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of the `publify_core` rubygem, publisher on a `publify` application is able to perform a cross-site scripting (XSS) attack…

    publify publify publify_core RubyGems
  • High 8.1
    CVE-2023-0569

    Weak Password Requirements in publify/publify

    Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.

    publify publify/publify publify_core RubyGems
  • High 8.4
    CVE-2023-0299

    Improper Input Validation in publify/publify

    Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.

    publify publify/publify publify_core RubyGems
  • High 7.6
    CVE-2022-1812 EPSS 31%

    Integer Overflow or Wraparound in publify/publify

    Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10.

    publify publify/publify publify_core RubyGems
  • Medium 4.6
    CVE-2022-2815

    Insecure Storage of Sensitive Information in publify/publify

    Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10.

    publify publify/publify publify_core RubyGems
  • Critical 9.1
    CVE-2022-1811

    Unrestricted Upload of File with Dangerous Type in publify/publify

    Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.

    publify publify/publify publify_core RubyGems
  • Critical 9.9
    CVE-2022-1810

    Authorization Bypass Through User-Controlled Key in publify/publify

    Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9.

    publify publify/publify publify_core RubyGems
  • High 8.8
    CVE-2022-1553

    Leaking password protected articles content due to improper access control in publify/publify

    Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, co…

    publify publify/publify publify_core RubyGems
  • Medium 5.3
    CVE-2022-0578

    Code Injection in publify/publify

    Code Injection in GitHub repository publify/publify prior to 9.2.8.

    publify publify/publify publify_core RubyGems
  • Medium 5.3
    CVE-2022-0574

    Improper Access Control in publify/publify

    Improper Access Control in GitHub repository publify/publify prior to 9.2.8.

    publify publify/publify publify_core RubyGems
  • Medium 6.5
    CVE-2022-0524

    Business Logic Errors in publify/publify

    Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.

    publify publify/publify publify_core RubyGems
  • Medium 5.4
    CVE-2021-25975

    Publify - Stored Cross-Site Scripting (XSS) due to Unrestricted File Upload

    In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file.

    publify_core publify_core publify_core RubyGems
  • Medium 5.4
    CVE-2021-25974

    Publify - Stored Cross-Site Scripting (XSS) in Editor

    In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a “publisher” role is able to inject and execute arbitrary JavaScript code while creating a page/article.

    publify_core publify_core publify_core RubyGems
  • Medium 6.5
    CVE-2021-25973

    Publify - Improper Authorization Leads to Guest Signup Restriction Bypass

    In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only.

    publify_core publify_core publify_core RubyGems
  • High 7.5
    CVE-2014-3211

    Publify vulnerable to DoS attack

    Publify before 8.0.1 is vulnerable to a Denial of Service attack

    publify_core RubyGems