Ghost Foundation Ghost vulnerabilities

CVE-2022-41697 [MEDIUM] CWE-204 CVE-2022-41697: A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability.

CVE-2024-34559 [HIGH] CWE-532 CVE-2024-34559: Insertion of Sensitive Information into Log File vulnerability in Ghost Foundation Ghost.This issue Insertion of Sensitive Information into Log File vulnerability in Ghost Foundation Ghost.This issue affects Ghost: from n/a through 1.4.0.

CVE-2022-41654 [MEDIUM] CWE-284 CVE-2022-41654: An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.

CVE-2022-47197 [MEDIUM] CWE-453 CVE-2022-47197: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghos An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Jav

CVE-2022-47194 [MEDIUM] CWE-453 CVE-2022-47194: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghos An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Jav

CVE-2022-47196 [MEDIUM] CWE-453 CVE-2022-47196: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghos An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Jav

CVE-2022-47195 [MEDIUM] CWE-453 CVE-2022-47195: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghos An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Jav