Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. Workarounds Upgrading is required, no other workaround is present.
Recommended action: Upgrade to 15.55.0 or 14.93.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Making crafted requests could lead to information disclosure that could further lead to account takeover. Workarounds There's no workaround to fix this without upgrading. Credits Thanks to Thanh of Calif.io for reporting the issue
Recommended action: Upgrade to 15.51.0 or 14.89.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A system user was able to create certain documents in a specific way that could lead to RCE. Workarounds There's no workaround, an upgrade is required. Credits Thanks to Thanh of Calif.io for reporting the issue
Recommended action: Upgrade to 15.52.0 or 14.91.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Workarounds Upgrading is required, no other workaround is present. Credits Thanks to Thanh of Calif.io for reporting the issue
Recommended action: Upgrade to 15.51.0 or 14.89.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.