CVSS: 10.0EPSS: 93%CPEs: 4EXPL: 3CVE-2023-35813 – Sitecore 8.2 Remote Code Execution
https://notcve.org/view.php?id=CVE-2023-35813
17 Jun 2023 — Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3. Sitecore version 8.2 suffers from a remote code execution vulnerability. • https://packetstorm.news/files/id/177524 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2023-33651
https://notcve.org/view.php?id=CVE-2023-33651
06 Jun 2023 — An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules. • https://blog.assetnote.io/2023/05/10/sitecore-round-two • CWE-863: Incorrect Authorization •
CVSS: 9.0EPSS: 2%CPEs: 1EXPL: 1CVE-2023-33652
https://notcve.org/view.php?id=CVE-2023-33652
06 Jun 2023 — Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx. • https://blog.assetnote.io/2023/05/10/sitecore-round-two • CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') •
CVSS: 9.0EPSS: 2%CPEs: 1EXPL: 1CVE-2023-33653
https://notcve.org/view.php?id=CVE-2023-33653
06 Jun 2023 — Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML. • https://blog.assetnote.io/2023/05/10/sitecore-round-two •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 1CVE-2023-27068
https://notcve.org/view.php?id=CVE-2023-27068
23 May 2023 — Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx. • https://blogs.night-wolf.io/0-day-vulnerabilities-at-sitecore-pagedesigner • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27066
https://notcve.org/view.php?id=CVE-2023-27066
22 May 2023 — Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle. • https://blogs.night-wolf.io/0-day-vulnerabilities-at-sitecore-pagedesigner • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27067
https://notcve.org/view.php?id=CVE-2023-27067
22 May 2023 — Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx • https://blogs.night-wolf.io/0-day-vulnerabilities-at-sitecore-pagedesigner • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.3EPSS: 7%CPEs: 2EXPL: 1CVE-2023-26262
https://notcve.org/view.php?id=CVE-2023-26262
14 Mar 2023 — An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server. • https://github.com/istern/CVE-2023-26262 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 94%CPEs: 24EXPL: 5CVE-2021-42237 – Sitecore XP Remote Command Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-42237
05 Nov 2021 — Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability. Sitecore XP Versión Inicial 7.5 a Sitecore XP 8.2 Update-7, es vulnerable a un ataque de deserialización no segura donde es posible lograr una ejecución de comandos remotos en la máquina. No es requerida ninguna autenticación ni configuració... • https://packetstorm.news/files/id/164988 • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 3CVE-2019-13493 – Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-13493
12 Jul 2019 — In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript. En Sitecore versión 9.0 rev 171002, presenta un problema de tipo XSS persistente en la Biblioteca Multimedia y en el Administrador de Archivos. Un usuario sin privilegios autenticado puede modificar el parámetro extensión de archivo cargado para inyectar JavaScript arbitrario. Sitecore version 9.0 rev 1710... • https://packetstorm.news/files/id/153613 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •