CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34530
https://notcve.org/view.php?id=CVE-2022-34530
01 Aug 2022 — An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames. Un problema en la funcionalidad login and reset de Backdrop CMS versión v1.22.0, permite a atacantes enumerar los nombres de usuario por medio de peticiones de restablecimiento de contraseñas y las distintas respuestas devueltas basadas en los nombres de usuario • http://backdrop.com • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1000813
https://notcve.org/view.php?id=CVE-2018-1000813
20 Dec 2018 — Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user must be directed to an affected page while logged in.. This vulnerability appears to have been fixed in 1.11.1 and later. Backdrop CMS, en versiones 1.11.0 y anteriores, contiene una vulnerabilidad Cross-Site Scripting (XSS) en el sane... • https://backdropcms.org/security/backdrop-sa-core-2018-005 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •