CVSS: 4.6EPSS: 0%CPEs: 4EXPL: 0CVE-2024-35218 – Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane
https://notcve.org/view.php?id=CVE-2024-35218
21 May 2024 — Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer. Umbraco CMS es un CMS ASP.NET utilizado por más de 730.000 sitios web. El Cross Site Scripting (XSS) Almacenado permite a los atacantes que tienen acceso al backoffice introducir contenido mal... • https://github.com/umbraco/Umbraco-CMS/commit/1b712fe6ec52aa4e71b3acf63e393c8e6ab85385 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2024-34071 – Open Redirect Bypass Protection
https://notcve.org/view.php?id=CVE-2024-34071
21 May 2024 — Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in version(s) 8.18.14, 10.8.6, 12.3.10 and 13.3.1. Umbraco es un CMS ASP.NET utilizado por más de 730.000 sitios web. • https://github.com/umbraco/Umbraco-CMS/commit/5f24de308584b9771240a6db1a34630a5114c450 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29035 – Umbraco's Blind SSRF Leads to Port Scan by using Webhooks
https://notcve.org/view.php?id=CVE-2024-29035
17 Apr 2024 — Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1. Umbraco es un CMS ASP.NET. • https://github.com/umbraco/Umbraco-CMS/commit/6b8067815c02ae43161966a8075a3585e1bc4de0 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 3.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28868 – Umbraco possible user enumeration vulnerability
https://notcve.org/view.php?id=CVE-2024-28868
20 Mar 2024 — Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins. Umbraco es un sistema de gestión de contenidos ASP.NET. • https://github.com/umbraco/Umbraco-CMS/commit/7e1d1a1968000226cd882fff078b122b8d46c44d • CWE-204: Observable Response Discrepancy •