CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-48649
https://notcve.org/view.php?id=CVE-2023-48649
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name. Concrete CMS anterior a 8.5.13 y 9.x anterior a 9.2.2 permite almacenar XSS en la página de Administración a través de un nombre de archivo cargado. • https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes https://github.com/concretecms/concretecms/pull/11695 https://github.com/concretecms/concretecms/pull/11739 https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-44760
https://notcve.org/view.php?id=CVE-2023-44760
Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature. Also, the exploitation method claimed by "sromanhu" does not provide any access to a Concrete CMS session, because the Concrete CMS session cookie is configured as HttpOnly. Múltiples vulnerabilidades de Cross Site Scripting (XSS) en Concrete CMS v.9.2.1 permiten a un atacante ejecutar código arbitrario a través de un script manipulado para los códigos de seguimiento de encabezado y pie de página de SEO y estadísticas. • https://github.com/sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes/issues/1 https://github.com/sromanhu/ConcreteCMS-Stored-XSS---TrackingCodes https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-concrete-cms-rejects-cve-2023-44760-and-cve-2023-44766 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-44763
https://notcve.org/view.php?id=CVE-2023-44763
Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the allowed file types in the default configuration. ** EN DISPUTA ** Concrete CMS v9.2.1 se ve afectado por una vulnerabilidad de carga arbitraria de archivos mediante la carga de un archivo en miniatura, que permite Cross-Site Scripting (XSS). NOTA: la posición del proveedor es que se supone que el cliente debe saber que "pdf" debe excluirse de los tipos de archivos permitidos, aunque pdf sea uno de los tipos de archivos permitidos en la configuración predeterminada. • https://github.com/sromanhu/ConcreteCMS-Arbitrary-file-upload-Thumbnail https://web.archive.org/web/20231026034159/https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/allowed-file-types https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-25-concrete-cms-rejects-cve-2023-44763 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-44761
https://notcve.org/view.php?id=CVE-2023-44761
Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects. Múltiples vulnerabilidades de Cross Site Scripting (XSS) en Concrete CMS v.9.2.1 permiten a un atacante local ejecutar código arbitrario a través de un script manipulado en los formularios de los objetos de datos. • https://github.com/sromanhu/ConcreteCMS-Stored-XSS---Forms https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-44764
https://notcve.org/view.php?id=CVE-2023-44764
A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings). Una vulnerabilidad de Cross Site Scripting (XSS) en Concrete CMS v.9.2.1 permite a un atacante ejecutar código arbitrario a través de un script manipulado en el parámetro SITE desde la instalación o en la Configuración. • https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes https://github.com/sromanhu/ConcreteCMS-Stored-XSS---Site_Installation • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •