CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-42097
https://notcve.org/view.php?id=CVE-2022-42097
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' . Se descubrió que la versión 1.23.0 de Background CMS contiene una vulnerabilidad de Cross-Site Scripting (XSS) Almacenado a través de 'Comment.'. • https://github.com/bypazs/CVE-2022-42097 https://backdropcms.org https://github.com/backdrop/backdrop/releases/tag/1.23.0 https://grimthereaperteam.medium.com/cve-2022-42097-backdrop-xss-at-comments-2ea536ec55e1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-42096
https://notcve.org/view.php?id=CVE-2022-42096
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content. Se descubrió que la versión 1.23.0 de Backdrop CMS contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenadas a través del contenido de la publicación. • https://github.com/bypazs/CVE-2022-42096 https://backdropcms.org https://github.com/backdrop/backdrop/releases/tag/1.23.0 https://grimthereaperteam.medium.com/cve-2022-42096-backdrop-xss-at-posts-437c305036e2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 16%CPEs: 1EXPL: 1CVE-2022-42092
https://notcve.org/view.php?id=CVE-2022-42092
Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this and argue that advanced permissions are required. Backdrop CMS versión 1.22.0, presenta una vulnerabilidad de carga de archivos sin restricciones por medio de "themes" que permite a atacantes una Ejecución de Código Remota • https://grimthereaperteam.medium.com/backdrop-cms-1-22-0-unrestricted-file-upload-themes-ad42a599561c • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34530
https://notcve.org/view.php?id=CVE-2022-34530
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames. Un problema en la funcionalidad login and reset de Backdrop CMS versión v1.22.0, permite a atacantes enumerar los nombres de usuario por medio de peticiones de restablecimiento de contraseñas y las distintas respuestas devueltas basadas en los nombres de usuario • http://backdrop.com https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2022-24590
https://notcve.org/view.php?id=CVE-2022-24590
A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML. Una vulnerabilidad de tipo cross-site scripting (XSS) almacenada en la función Add Link de BackdropCMS versión v1.21.1, permite a atacantes ejecutar scripts web o HTML arbitrarios • https://github.com/Nguyen-Trung-Kien/CVE https://github.com/Nguyen-Trung-Kien/CVE/blob/main/CVE-2022-24590/CVE-2022-24590.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •