CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-37783
https://notcve.org/view.php?id=CVE-2022-37783
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework. Todas las versiones de Craft CMS entre 3.0.0 y 3.7.32 revelan hashes de contraseñas de usuarios que se autentican utilizando su dirección de correo electrónico o nombre de usuario en tokens Anti-CSRF. Craft CMS utiliza una cookie llamada CRAFT_CSRF_TOKEN y un campo oculto HTML llamado CRAFT_CSRF_TOKEN para evitar ataques de Cross Site Request Forgery. • http://www.openwall.com/lists/oss-security/2024/06/06/1 https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes https://cves.at/posts/cve-2022-37783/writeup • CWE-522: Insufficiently Protected Credentials •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37246
https://notcve.org/view.php?id=CVE-2022-37246
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label. Craft CMS versión 4.2.0.1, está afectado por una vulnerabilidad de tipo Cross Site Scripting (XSS) en el archivo src/web/assets/cp/src/js/BaseElementSelectInput.js y en concreto en la línea label: elementInfo.label • https://github.com/craftcms/cms/commit/1d5fdba23c84d6d09a8a980c7b6fc52fb93b679b https://labs.integrity.pt/advisories/cve-2022-37246 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37251
https://notcve.org/view.php?id=CVE-2022-37251
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts. Craft CMS versión 4.2.0.1, es vulnerable a un ataque de tipo Cross Site Scripting (XSS) por medio de Drafts • http://craft.com https://labs.integrity.pt/advisories/cve-2022-37251 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37247
https://notcve.org/view.php?id=CVE-2022-37247
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page. Craft CMS versión 4.2.0.1, es vulnerable a un ataque de tipo cross-site scripting (XSS) almacenado por medio de la página /admin/settings/fields • https://github.com/craftcms/cms/commit/cedeba0609e4b173cd584dae7f33c5f713f19627 https://labs.integrity.pt/advisories/cve-2022-37247 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-37248
https://notcve.org/view.php?id=CVE-2022-37248
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php. Craft CMS versión 4.2.0.1, es vulnerable a un ataque de tipo Cross Site Scripting (XSS) por medio del archivo src/helpers/Cp.php • https://github.com/craftcms/cms/commit/cedeba0609e4b173cd584dae7f33c5f713f19627 https://labs.integrity.pt/advisories/cve-2022-37248 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •