Page 2 of 11 results (0.011 seconds)

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 3

CVE-2020-5811 – Umbraco CMS 8.9.1 - Directory Traversal

https://notcve.org/view.php?id=CVE-2020-5811

An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package. Se presenta una vulnerabilidad de salto de ruta autenticada durante la instalación del paquete en Umbraco CMS versiones anteriores a 8.9.1 o actual, lo que podría resultar en la escritura de archivos arbitrarios fuera del inicio del sitio y las rutas esperadas cuando se instala un paquete Umbraco. Umbraco CMS versions 8.9.1 and below suffer from path traversal and arbitrary file write vulnerabilities. • https://www.exploit-db.com/exploits/50241 http://packetstormsecurity.com/files/163965/Umbraco-CMS-8.9.1-Traversal-Arbitrary-File-Write.html https://www.tenable.com/security/research/tra-2020-59 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2014-10074

https://notcve.org/view.php?id=CVE-2014-10074

Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files. Umbraco en versiones anteriores a la 7.2.0 tiene una vulnerabilidad de ejecución remota de código PHP debido a que Umbraco.Web.UI/config/umbracoSettings.Release.config no bloquea la subida de archivos .php. • http://issues.umbraco.org/issue/U4-5901 https://github.com/Umbraco/Umbraco-CMS/commit/cad06502235acabf7fb7dca779d2f78f08547e39 • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-15279

https://notcve.org/view.php?id=CVE-2017-15279

Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs. Vulnerabilidad Cross-Site Scripting (XSS) en Umbraco CMS en versiones anteriores a la 7.7.3 permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante el parámetro "page name" (también conocido como nodename) durante la creación de una nueva página. Esto está relacionado con Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs y Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs. • http://issues.umbraco.org/issue/U4-10497 https://github.com/umbraco/Umbraco-CMS/commit/fe2b86b681455ac975b294652064b2718d4e2ba2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-15280

https://notcve.org/view.php?id=CVE-2017-15280

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs. Vulnerabilidad XEE (XML External Entity) en Umbraco CMS en versiones anteriores 7.7.3 permite que atacantes obtengan información sensible leyendo archivos en el servidor o enviando peticiones TCP a hosts de la intranet (también conocido como SSRF). Esto está relacionado con Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs. • http://issues.umbraco.org/issue/U4-10506 https://github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64 • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2013-4793

https://notcve.org/view.php?id=CVE-2013-4793

The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request. La función update en umbraco.webservices/templates/templateService.cs en el componente TemplateService en Umbraco CMS anterior a 6.0.4 no requiere autenticación, lo que permite a atacantes remotos ejecutar código ASP.NET arbitrario a través de una petición SOAP modificada. • https://labs.mwrinfosecurity.com/advisories/2013/11/29/umbraco-cms-templateservice-remote-code-execution • CWE-287: Improper Authentication •