CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2614 – Cross-site Scripting (XSS) - DOM in pimcore/pimcore
https://notcve.org/view.php?id=CVE-2023-2614
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21. • https://github.com/pimcore/pimcore/commit/c36ef54ce33f7b5e74b7b0ab9eabfed47c018fc7 https://huntr.dev/bounties/1a5e6c65-2c5e-4617-9411-5b47a7e743a6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2615 – Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
https://notcve.org/view.php?id=CVE-2023-2615
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. • https://github.com/pimcore/pimcore/commit/7a799399e6843cd049e85da27ceb75b78505317f https://huntr.dev/bounties/af9c360a-87f8-4e97-a24b-6db675ee942a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2616 – Cross-site Scripting (XSS) - Generic in pimcore/pimcore
https://notcve.org/view.php?id=CVE-2023-2616
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21. • https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091 https://huntr.dev/bounties/564cb512-2bcc-4458-8c20-88110ab45801 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2630 – Cross-site Scripting (XSS) - Stored in pimcore/pimcore
https://notcve.org/view.php?id=CVE-2023-2630
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. • https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38 https://huntr.dev/bounties/e1001870-b8d8-4921-8b9c-bbdfb1a1491e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30855 – Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php
https://notcve.org/view.php?id=CVE-2023-30855
Pimcore is an open source data and experience management platform. Versions of Pimcore prior to 10.5.18 are vulnerable to path traversal. The impact of this path traversal and arbitrary extension is limited to creation of arbitrary files and appending data to existing files. When combined with the SQL Injection, the exported data `RESTRICTED DIFFUSION 9 / 9` can be controlled and a webshell can be uploaded. Attackers can use that to execute arbitrary PHP code on the server with the permissions of the webserver. • https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e.patch https://github.com/pimcore/pimcore/pull/14498 https://github.com/pimcore/pimcore/security/advisories/GHSA-g2mc-fqqc-hxg3 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •