CVSS: 5.2EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15247 – Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.
https://notcve.org/view.php?id=CVE-2020-15247
23 Nov 2020 — October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyon... • https://github.com/octobercms/october/commit/4c650bb775ab849e48202a4923bac93bd74f9982 • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2020-15246 – Local File Inclusion by unauthenticated users
https://notcve.org/view.php?id=CVE-2020-15246
23 Nov 2020 — October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an attacker can read local files on an October CMS server via a specially crafted request. Issue has been patched in Build 469 (v1.0.469) and v1.1.0. October es una plataforma CMS gratuita, de código abierto y autohosteada basada en Laravel PHP Framework. En el CMS de octubre desde la versión 1.0.421 y anterior a versión 1.0.469, un atacante puede ... • https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-863: Incorrect Authorization •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15128 – Reliance on Cookies without validation in OctoberCMS
https://notcve.org/view.php?id=CVE-2020-15128
31 Jul 2020 — In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a... • https://github.com/octobercms/library/commit/28310d4fb336a1741b39498f4474497644a6875c • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 3CVE-2020-11083 – Stored XSS in October
https://notcve.org/view.php?id=CVE-2020-11083
14 Jul 2020 — In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1. En octubre, desde versión 1.0.319 y anterior a versión 1.0.466, un usuario con acceso a un FormWidget de descuento que almacena datos persistentemente ... • https://packetstorm.news/files/id/158730 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-4061 – Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websites
https://notcve.org/view.php?id=CVE-2020-4061
02 Jul 2020 — In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This has been fixed in 1.0.467. En October desde versión 1.0.319 y anteriores a versión 1.0.467, al pegar contenido copiado desde sitios web maliciosos en el Froala richeditor podría resultar en un ataque con éxito de tipo auto-XSS. Esto ha sido corregido en versión 1.0.467 • https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-5299 – Potential CSV Injection vector in OctoberCMS
https://notcve.org/view.php?id=CVE-2020-5299
03 Jun 2020 — In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 1. Have found a vulnerability in the victims spreadsheet software of choice. 2. Contr... • https://packetstorm.news/files/id/158730 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.2EPSS: 1%CPEs: 1EXPL: 3CVE-2020-5296 – Arbitrary File Deletion vulnerability in OctoberCMS
https://notcve.org/view.php?id=CVE-2020-5296
03 Jun 2020 — In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466). En OctoberCMS (paquete de compositor october/october) versiones desde 1.0.319 y anteriores a 1.0.466, un atacante puede explotar esta vulnerabilidad para elimin... • https://packetstorm.news/files/id/158730 • CWE-73: External Control of File Name or Path CWE-610: Externally Controlled Reference to a Resource in Another Sphere •
CVSS: 4.0EPSS: 1%CPEs: 1EXPL: 3CVE-2020-5297 – Upload whitelisted files to any directory in OctoberCMS
https://notcve.org/view.php?id=CVE-2020-5297
03 Jun 2020 — In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466). En OctoberCMS (paquete de compositor october/october)... • https://packetstorm.news/files/id/158730 • CWE-73: External Control of File Name or Path CWE-610: Externally Controlled Reference to a Resource in Another Sphere •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 3CVE-2020-5298 – Reflected XSS when importing CSV in OctoberCMS
https://notcve.org/view.php?id=CVE-2020-5298
03 Jun 2020 — In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466). En OctoberCMS (paquete de compositor october/october) versiones desde 1.0.319 y anteriores a 1.0.466, un usuario con la habi... • https://packetstorm.news/files/id/158730 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-87: Improper Neutralization of Alternate XSS Syntax •
CVSS: 4.9EPSS: 8%CPEs: 1EXPL: 4CVE-2020-5295 – Local File read vulnerability in OctoberCMS
https://notcve.org/view.php?id=CVE-2020-5295
03 Jun 2020 — In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466). En OctoberCMS (paquete de compositor october/october) versiones desde 1.0.319 y anteriores a 1.0.466, un atacante puede explotar esta vulnerabilidad para leer archivos loca... • https://packetstorm.news/files/id/158730 • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE-829: Inclusion of Functionality from Untrusted Control Sphere •