CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 1CVE-2021-38366
https://notcve.org/view.php?id=CVE-2021-38366
12 Aug 2021 — Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx file at an admin/Packages URL. Sitecore versiones hasta 10.1, cuando el Centro de Actualización está habilitado, permite a usuarios remotos autenticados cargar archivos arbitrarios y lograr una ejecución de código remota al visitar un archivo .aspx cargado en una URL de administración/Paquetes. • https://blog.istern.dk/2021/08/10/sitecore-10-authenticated-file-upload-to-rce • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11198
https://notcve.org/view.php?id=CVE-2019-11198
05 Aug 2019 — Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4) I#316995 - Icon Selection module, (5) #317000 - Latitude field, (6) #317000 - Longitude field, (7) #317017 - UploadPackage2.aspx module, (8) #317072 - Context menu, or (9) I#317073 - Insert from Template dialog. Múltiples vulnerabilidad... • https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/92/Sitecore%20Experience%20Platform%2092%20Initial%20Release/Release%20Notes • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 3CVE-2019-13493 – Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-13493
12 Jul 2019 — In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript. En Sitecore versión 9.0 rev 171002, presenta un problema de tipo XSS persistente en la Biblioteca Multimedia y en el Administrador de Archivos. Un usuario sin privilegios autenticado puede modificar el parámetro extensión de archivo cargado para inyectar JavaScript arbitrario. Sitecore version 9.0 rev 1710... • https://packetstorm.news/files/id/153613 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 25%CPEs: 1EXPL: 3CVE-2019-11080 – Sitecore 8.x - Deserialization Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-11080
06 Jun 2019 — Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object. Sitecore Experience Platform (XP) anterior a versión 9.1.1 es vulnerable a la ejecución de código remota por medio de la deserialización, también se conoce como TFS # 293863. Un usuario autenticado con los permisos necesarios es capaz de ejecutar remotamen... • https://packetstorm.news/files/id/153274 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 15%CPEs: 1EXPL: 1CVE-2019-9875 – Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
https://notcve.org/view.php?id=CVE-2019-9875
31 May 2019 — Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter. La deserialización de datos no confiables en el módulo anti CSRF en Sitecore hasta la versón 9.1, permite a un atacante identificado ejecutar código arbitrario mediante el envío un objeto .NET serializado dentro de un parámetro POST de HTTP. Sitecore CMS and Experience Platform (XP) contain a deserializatio... • https://dev.sitecore.net/Downloads.aspx • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 23%CPEs: 2EXPL: 1CVE-2019-9874 – Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
https://notcve.org/view.php?id=CVE-2019-9874
31 May 2019 — Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN. La deserialización de datos no seguros en el módulo Sitecore.Security.AntiCSRF (conocido como CSRF) en Sitecore CMS versión 7.0 hasta 7.2 y Sitecore XP verisón 7.5 hasta 8.2, permite a un atacante no identificado ejecutar código a... • https://dev.sitecore.net/Downloads.aspx • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12440
https://notcve.org/view.php?id=CVE-2019-12440
29 May 2019 — The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard Rocks Service. El complemento Sitecore Rocks anterior a versión 2.1.149 para Sitecore permite a un actor de amenazas no autorizado inyectar comandos y códigos maliciosos por medio del servicio Sitecore Rocks Hard Rocks. • https://github.com/Sitecore/Sitecore.Rocks/compare/be79dcc...bd9ba6a • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 25%CPEs: 4EXPL: 4CVE-2018-7669 – Sitecore.Net 8.1 - Directory Traversal
https://notcve.org/view.php?id=CVE-2018-7669
26 Apr 2018 — An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' application is vulnerable to a directory traversal attack, allowing an attacker to access arbitrary files from the host Operating System using a sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file= URI. Validation is performed to ensure that the text passed to the 'file' parameter correlates to the correct log file directory. This filter can be bypassed by including a valid log filename and ... • https://packetstorm.news/files/id/147367 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2017-11439
https://notcve.org/view.php?id=CVE-2017-11439
19 Jul 2017 — In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter. En Sitecore versión 8.2, se presenta un problema de tipo XSS reflejado del parámetro Program del archivo shell/Applications/Tools/Run. • https://packetstormsecurity.com/files/143357/Sitecore-CMS-8.2-Cross-Site-Scripting-File-Disclosure.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 2CVE-2017-11440
https://notcve.org/view.php?id=CVE-2017-11440
19 Jul 2017 — In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter. En Sitecore versión 8.2, se presenta un salto de ruta (path) de acceso absoluto por medio del parámetro fi del archivo shell/Applications/Layouts/IDE.aspx y el parámetro Reference del archivo admin/LinqScratchPad.aspx. • https://packetstormsecurity.com/files/143357/Sitecore-CMS-8.2-Cross-Site-Scripting-File-Disclosure.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •