Vendor
TryGhost
88 known vulnerabilities.
Products
7 results · Clear filters · Feed
-
Low 3.8
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0.
-
Low 2.7
Ghost: Server-Side Request Forgery in Webhook Trigger
Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.
-
Low 3.1
Ghost: Password Hash Ordering Disclosure in Ghost Admin API
Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical p…
-
Low 3.1
Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer…
-
Low 3.8
Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended da…
-
Low 2.7
Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources fr…
-
Low 3.7
Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header
Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-c…