CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-9280
https://notcve.org/view.php?id=CVE-2020-9280
In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is installed and enabled by default on the Common Web Platform (CWP). The vulnerability only affects files uploaded after an upgrade to 4.x. En SilverStripe versiones hasta 4.5, los archivos cargados por medio de Formularios hacia carpetas migradas desde Silverstripe CMS versiones 3.x, pueden ser colocados en la carpeta predeterminada "/Uploads". • https://forum.silverstripe.org/c/releases https://www.silverstripe.org/download/security-releases https://www.silverstripe.org/download/security-releases/cve-2020-9280 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19325
https://notcve.org/view.php?id=CVE-2019-19325
SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input. SilverStripe versiones hasta 4.4.x anteriores a 4.4.5 y versiones 4.5.x anteriores a 4.5.2, permite un ataque de tipo XSS Reflejado en el formulario de inicio de sesión y formularios personalizados. Silverstripe Forms permite insertar HTML o JavaScript malicioso por medio de atributos FormField no escalares, lo que permite llevar a cabo un ataque de tipo XSS (Cross-Site Scripting) en algunos formularios creados con la entrada del usuario (Request data). • https://www.silverstripe.org/download/security-releases/cve-2019-19325 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •