CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32470
https://notcve.org/view.php?id=CVE-2021-32470
Craft CMS before 3.6.13 has an XSS vulnerability. Un CMS diseñado, versiones anteriores a 3.6.13, presenta una vulnerabilidad de tipo XSS • https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3613---2021-05-04 https://github.com/craftcms/cms/commit/f9378aa154b5f9b64bed3d59cce0c4a8184bf5e6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-19626
https://notcve.org/view.php?id=CVE-2020-19626
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en craftcms versión 3.1.31, permite a atacantes remotos inyectar un script web o HTML arbitrario, por medio de /admin/settings/sites/new. • http://mayoterry.com/file/cve/XSS_vuluerability_in_Craftcms_3.1.31.pdf https://github.com/craftcms/cms/commit/76a2168b6a5e30144f5c06da4ff264f4eca577ff • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 95%CPEs: 1EXPL: 1CVE-2020-9757
https://notcve.org/view.php?id=CVE-2020-9757
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller. El componente Seomatic versiones anteriores a 3.3.0 para Craft CMS permite una Inyección de tipo Server-Side Template y una divulgación de información por medio de datos malformados en el controlador de metacontenedores. • https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17496
https://notcve.org/view.php?id=CVE-2019-17496
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion. Craft CMS versiones anteriores a la verisón 3.3.8, tiene una vulnerabilidad de tipo XSS almacenado por medio de un campo name. Este campo es manejado inapropiadamente durante la eliminación del sitio • https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09 https://github.com/craftcms/cms/commit/0ee66d29281af2b6c4f866e1437842c61983a672 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 2%CPEs: 2EXPL: 1CVE-2019-14280 – Craft CMS 2.7.9/3.2.5 - Information Disclosure
https://notcve.org/view.php?id=CVE-2019-14280
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public. En algunas circunstancias, Craft versiones 2 anteriores a 2.7.10 y versiones 3 anteriores a 3.2.6, no estaba eliminando los datos EXIF ??de las imágenes subidas por el usuario cuando estaba configurado para hacerlo, lo que expone potencialmente al público los datos personales y de geolocalización. Craft CMS versions 2.7.9 and 3.2.5 suffers from an information disclosure vulnerability. • https://www.exploit-db.com/exploits/47343 http://packetstormsecurity.com/files/154276/Craft-CMS-2.7.9-3.2.5-Information-Disclosure.html https://github.com/craftcms/cms/blob/develop-v2/CHANGELOG-v2.md#2710---2019-07-24 https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#326---2019-07-23 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •