CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34530
https://notcve.org/view.php?id=CVE-2022-34530
01 Aug 2022 — An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames. Un problema en la funcionalidad login and reset de Backdrop CMS versión v1.22.0, permite a atacantes enumerar los nombres de usuario por medio de peticiones de restablecimiento de contraseñas y las distintas respuestas devueltas basadas en los nombres de usuario • http://backdrop.com • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2022-24590
https://notcve.org/view.php?id=CVE-2022-24590
15 Feb 2022 — A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML. Una vulnerabilidad de tipo cross-site scripting (XSS) almacenada en la función Add Link de BackdropCMS versión v1.21.1, permite a atacantes ejecutar scripts web o HTML arbitrarios • https://github.com/Nguyen-Trung-Kien/CVE • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-45268
https://notcve.org/view.php?id=CVE-2021-45268
03 Feb 2022 — A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cookie of a high-privileged authenticated user who is entitled to install arbitrary add-ons ** EN DISPUTA ** Se presenta una vulnerabilidad de tipo Cross Site Request Forgery (CSRF) en Backdrop CMS versión 1.20, que... • https://github.com/V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19900
https://notcve.org/view.php?id=CVE-2019-19900
19 Dec 2019 — An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying content type names in the content creation interface. An attacker could potentially craft a specialized content type name, then have an editor execute scripting when creating content, aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the "Administer content types" permission. Se detectó un problema en Backdrop CMS versiones 1.1... • https://backdropcms.org/security/backdrop-sa-core-2019-014 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 1%CPEs: 2EXPL: 0CVE-2019-19902
https://notcve.org/view.php?id=CVE-2019-19902
19 Dec 2019 — An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be required to have the "Synchronize, import, and export configuration" permission, a permission that only trusted adm... • https://backdropcms.org/security/backdrop-sa-core-2019-016 • CWE-20: Improper Input Validation •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19903
https://notcve.org/view.php?id=CVE-2019-19903
19 Dec 2019 — An issue was discovered in Backdrop CMS 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying file type descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when viewing the list of file types, aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the "Administer file types" permission. Se detectó un problema en Backdrop CMS versiones 1.14.x anteriores a ... • https://backdropcms.org/security/backdrop-sa-core-2019-015 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19901
https://notcve.org/view.php?id=CVE-2019-19901
19 Dec 2019 — An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when configuring a layout, aka XSS. This issue is mitigated by the fact that the attacker would be required to have the permission to create custom blocks, which is typically an administrative task. Se detectó... • https://backdropcms.org/security/backdrop-sa-core-2019-013 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-14769
https://notcve.org/view.php?id=CVE-2019-14769
08 Aug 2019 — Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators. An attacker could potentially craft a specialized label, then have an administrator execute scripting when administering a layout. (This issue is mitigated by the attacker needing permission to create custom blocks on the site, which is typically an administrative permission.) CMS de Backdrop versiones 1.12.x anteriores a 1.12.8 y versiones 1.13.x ante... • https://backdropcms.org/security/backdrop-sa-core-2019-011 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-14770
https://notcve.org/view.php?id=CVE-2019-14770
08 Aug 2019 — In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaScript when the administrator is logged in and uses the search functionality. (This issue is mitigated by the attacker needing permissions to create administrative menu links, such as by creating a content type or layout. Such permissions are usually restricted to trusted or administrative users.) En CMS de Backdrop versiones 1.12.x anteriores a 1.12.8 y versiones 1.13.x... • https://backdropcms.org/security/backdrop-sa-core-2019-010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2019-14771
https://notcve.org/view.php?id=CVE-2019-14771
08 Aug 2019 — Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, potentially allowing non-configuration scripts to be uploaded to the server. (This attack is mitigated by the attacker needing the "Synchronize, import, and export configuration" permission, a permission that only trusted administrators should be given. Other preventative measures in B... • https://backdropcms.org/security/backdrop-sa-core-2019-012 • CWE-20: Improper Input Validation •