CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-15929 – Craft CMS Rate Limiting / Brute Force
https://notcve.org/view.php?id=CVE-2019-15929
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them. En Craft CMS versiones hasta 3.1.7, la petición de contraseña de sesión elevada no estaba siendo limitada como en los formularios de inicio de sesión normales, conllevando a la posibilidad de un intento de fuerza bruta sobre ellos. Craft CMS versions up to 3.1.7 are missing rate limiting on password validations. • http://packetstormsecurity.com/files/155012/Craft-CMS-Rate-Limiting-Brute-Force.html https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#317---2019-01-31 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17496
https://notcve.org/view.php?id=CVE-2019-17496
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion. Craft CMS versiones anteriores a la verisón 3.3.8, tiene una vulnerabilidad de tipo XSS almacenado por medio de un campo name. Este campo es manejado inapropiadamente durante la eliminación del sitio • https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09 https://github.com/craftcms/cms/commit/0ee66d29281af2b6c4f866e1437842c61983a672 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 2%CPEs: 2EXPL: 1CVE-2019-14280 – Craft CMS 2.7.9/3.2.5 - Information Disclosure
https://notcve.org/view.php?id=CVE-2019-14280
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public. En algunas circunstancias, Craft versiones 2 anteriores a 2.7.10 y versiones 3 anteriores a 3.2.6, no estaba eliminando los datos EXIF ??de las imágenes subidas por el usuario cuando estaba configurado para hacerlo, lo que expone potencialmente al público los datos personales y de geolocalización. Craft CMS versions 2.7.9 and 3.2.5 suffers from an information disclosure vulnerability. • https://www.exploit-db.com/exploits/47343 http://packetstormsecurity.com/files/154276/Craft-CMS-2.7.9-3.2.5-Information-Disclosure.html https://github.com/craftcms/cms/blob/develop-v2/CHANGELOG-v2.md#2710---2019-07-24 https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#326---2019-07-23 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12823
https://notcve.org/view.php?id=CVE-2019-12823
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. Craft CMS antes de la versión 3.1.31 no filtra correctamente los feeds XML y por lo tanto permite XSS • https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md https://github.com/craftcms/cms/commit/6432eca59b93bcea2ca2616199e5d419447e613f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2019-9554 – Craft CMS 3.1.12 Pro - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-9554
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI. En la versión 3.1.12 Pro de Craft CMS, se descubrió una vulnerabilidad de tipo XSS en el campo de inserción del encabezado cuando se agrega el código fuente en un URI s/admin/entries/news/new. Craft CMS version 3.1.12 Pro suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/46496 https://packetstormsecurity.com/files/151944/Craft-CMS-3.1.12-Pro-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •