CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32470
https://notcve.org/view.php?id=CVE-2021-32470
07 May 2021 — Craft CMS before 3.6.13 has an XSS vulnerability. Un CMS diseñado, versiones anteriores a 3.6.13, presenta una vulnerabilidad de tipo XSS • https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3613---2021-05-04 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-19626
https://notcve.org/view.php?id=CVE-2020-19626
26 Mar 2021 — Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en craftcms versión 3.1.31, permite a atacantes remotos inyectar un script web o HTML arbitrario, por medio de /admin/settings/sites/new. • http://mayoterry.com/file/cve/XSS_vuluerability_in_Craftcms_3.1.31.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 93%CPEs: 1EXPL: 1CVE-2020-9757
https://notcve.org/view.php?id=CVE-2020-9757
04 Mar 2020 — The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller. El componente Seomatic versiones anteriores a 3.3.0 para Craft CMS permite una Inyección de tipo Server-Side Template y una divulgación de información por medio de datos malformados en el controlador de metacontenedores. • https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-15929 – Craft CMS Rate Limiting / Brute Force
https://notcve.org/view.php?id=CVE-2019-15929
24 Oct 2019 — In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them. En Craft CMS versiones hasta 3.1.7, la petición de contraseña de sesión elevada no estaba siendo limitada como en los formularios de inicio de sesión normales, conllevando a la posibilidad de un intento de fuerza bruta sobre ellos. Craft CMS versions up to 3.1.7 are missing rate limiting on password validations. • https://packetstorm.news/files/id/155012 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17496
https://notcve.org/view.php?id=CVE-2019-17496
10 Oct 2019 — Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion. Craft CMS versiones anteriores a la verisón 3.3.8, tiene una vulnerabilidad de tipo XSS almacenado por medio de un campo name. Este campo es manejado inapropiadamente durante la eliminación del sitio • https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 15%CPEs: 2EXPL: 2CVE-2019-14280 – Craft CMS 2.7.9/3.2.5 - Information Disclosure
https://notcve.org/view.php?id=CVE-2019-14280
26 Jul 2019 — In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public. En algunas circunstancias, Craft versiones 2 anteriores a 2.7.10 y versiones 3 anteriores a 3.2.6, no estaba eliminando los datos EXIF ??de las imágenes subidas por el usuario cuando estaba configurado para hacerlo, lo que expone potencialmente al público los datos personales y de geolocalización. C... • https://packetstorm.news/files/id/154276 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12823
https://notcve.org/view.php?id=CVE-2019-12823
18 Jun 2019 — Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. Craft CMS antes de la versión 3.1.31 no filtra correctamente los feeds XML y por lo tanto permite XSS • https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 3CVE-2019-9554 – Craft CMS 3.1.12 Pro - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-9554
04 Mar 2019 — In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI. En la versión 3.1.12 Pro de Craft CMS, se descubrió una vulnerabilidad de tipo XSS en el campo de inserción del encabezado cuando se agrega el código fuente en un URI s/admin/entries/news/new. Craft CMS version 3.1.12 Pro suffers from a cross site scripting vulnerability. • https://packetstorm.news/files/id/151944 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20465
https://notcve.org/view.php?id=CVE-2018-20465
25 Dec 2018 — Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field. Craft CMS, hasta la versión 3.0.34, permite que administradores autenticados remotos lean información sensible mediante una inyección de plantillas del lado del servi... • https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 4CVE-2018-20418 – Craft CMS 3.0.25 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-20418
24 Dec 2018 — index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab. index.php?p=admin/actions/entries/save-entry en Craft CMS 3.0.25 permite Cross-Site Scripting (XSS) mediante el guardado de un nuevo título de la pestaña de la consola. Craft CMS version 3.0.25 suffers from a cross site scripting vulnerability. • https://packetstorm.news/files/id/150920 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •