CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1999008
https://notcve.org/view.php?id=CVE-2018-1999008
23 Jul 2018 — October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS). This vulnerability appears to have been fixed in build 437. October CMS en versiones anteriores a la build 437 con... • https://octobercms.com/support/article/rn-10 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2018-7198 – October CMS < 1.0.431 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-7198
18 Feb 2018 — October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page. October CMS hasta la versión 1.0.431 permite XSS mediante la introducción de HTML en la página Add Posts. October CMS versions prior to 1.0.431 suffer from a cross site scripting vulnerability. • https://packetstorm.news/files/id/146470 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16941
https://notcve.org/view.php?id=CVE-2017-16941
25 Nov 2017 — October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says "I don't think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering. ** EN DISPUTA **... • https://github.com/octobercms/october/issues/3257 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2017-16244 – OctoberCMS 1.0.426 (Build 426) - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2017-16244
01 Nov 2017 — Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable. Existe Cross-Site Request Forgery (CSRF) en OctoberCMS 1.0.426 (también conocido como Build 426) debido a la validación incorrecta de tokens CSRF para la gestión de postback, lo qu... • https://packetstorm.news/files/id/144852 • CWE-352: Cross-Site Request Forgery (CSRF) •