CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43377 – Umbraco CMS Improper Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-43377
Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2. • https://github.com/umbraco/Umbraco-CMS/commit/72bef8861d94a39d5cc9530a04c4797b91fcbecf https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hrww-x3fq-xcvh • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43376 – Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information
https://notcve.org/view.php?id=CVE-2024-43376
Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability is fixed in 14.1.2. • https://github.com/umbraco/Umbraco-CMS/commit/b76070c794925932cb159ef50b851db6e966a004 https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-77gj-crhp-3gvx • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 4.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-35218 – Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane
https://notcve.org/view.php?id=CVE-2024-35218
Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer. Umbraco CMS es un CMS ASP.NET utilizado por más de 730.000 sitios web. El Cross Site Scripting (XSS) Almacenado permite a los atacantes que tienen acceso al backoffice introducir contenido malicioso en un sitio web o aplicación. • https://github.com/umbraco/Umbraco-CMS/commit/1b712fe6ec52aa4e71b3acf63e393c8e6ab85385 https://github.com/umbraco/Umbraco-CMS/commit/a2684069b1e9976444f60b4b37a80be05b87f6b6 https://github.com/umbraco/Umbraco-CMS/commit/cbf9f9bcd199d7ca0412be3071d275556f10b7ba https://github.com/umbraco/Umbraco-CMS/commit/d090176272d07500dac0daee7c598aa8bb321050 https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-gvpc-3pj6-4m9w • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2024-34071 – Open Redirect Bypass Protection
https://notcve.org/view.php?id=CVE-2024-34071
Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in version(s) 8.18.14, 10.8.6, 12.3.10 and 13.3.1. Umbraco es un CMS ASP.NET utilizado por más de 730.000 sitios web. • https://github.com/umbraco/Umbraco-CMS/commit/5f24de308584b9771240a6db1a34630a5114c450 https://github.com/umbraco/Umbraco-CMS/commit/c17d4e1a600098ec524e4126f4395255476bc33f https://github.com/umbraco/Umbraco-CMS/commit/c8f71af646171074c13e5c34f74312def4512031 https://github.com/umbraco/Umbraco-CMS/commit/d8df405db4ea884bb4b96f088d10d9a2070cf024 https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-j74q-mv2c-rxmp • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29035 – Umbraco's Blind SSRF Leads to Port Scan by using Webhooks
https://notcve.org/view.php?id=CVE-2024-29035
Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1. Umbraco es un CMS ASP.NET. • https://github.com/umbraco/Umbraco-CMS/commit/6b8067815c02ae43161966a8075a3585e1bc4de0 https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-74p6-39f2-23v3 • CWE-918: Server-Side Request Forgery (SSRF) •