CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2015-8606
https://notcve.org/view.php?id=CVE-2015-8606
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm. Múltiples vulnerabilidades de XSS en SilverStripe CMS & Framework en versiones anteriores a 3.1.16 y 3.2.x en versiones anteriores a 3.2.1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) Locale o (2) FailedLogenCount en admen/security/EditForm/field/Members/item/new/ItemEditForm. • http://seclists.org/fulldisclosure/2015/Dec/55 http://www.openwall.com/lists/oss-security/2015/12/17/1 http://www.openwall.com/lists/oss-security/2015/12/17/11 http://www.openwall.com/lists/oss-security/2015/12/18/5 http://www.silverstripe.org/download/security-releases/ss-2015-026 https://cybersecurityworks.com/zerodays/cve-2015-8606-silverstripe.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 19EXPL: 1CVE-2012-4968
https://notcve.org/view.php?id=CVE-2012-4968
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted string to the AbsoluteLinks, (2) BigSummary, (3) ContextSummary, (4) EscapeXML, (5) FirstParagraph, (6) FirstSentence, (7) Initial, (8) LimitCharacters, (9) LimitSentences, (10) LimitWordCount, (11) LimitWordCountXML, (12) Lower, (13) LowerCase, (14) NoHTML, (15) Summary, (16) Upper, (17) UpperCase, or (18) URL method in a template, different vectors than CVE-2012-0976. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en SilverStripe v2.3.x antes de v2.3.13 y v2.4.x antes de v2.4.7 permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de una cadena modificada a los métodos (1) AbsoluteLinks, (2) BigSummary, (3) ContextSummary, (4) EscapeXML, (5) FirstParagraph, (6) FirstSentence, (7) Initial, (8) LimitCharacters, (9) LimitSentences, (10) Word Count Limit, (11) LimitWordCountXML, (12) Lower, (13) LowerCase, (14) NOHTML, (15) Summary, (16) Upper, (17) UpperCase, o (18) URL en una plantilla. Se trata de vectores diferentes a los de CVE-2012-0976a. • http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 https://github.com/silverstripe/sapphire/commit/0085876 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 1CVE-2012-0976
https://notcve.org/view.php?id=CVE-2012-0976
Cross-site scripting (XSS) vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter. NOTE: some of these details are obtained from third party information. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en admin/EditForm in SilverStripe v2.4.6 permite a usuarios remotos autenticados con privilegios de los autores de contenido para inyectar secuencias de comandos web o HTML a través del parámetro de título. NOTA: algunos de estos detalles han sido obtenidos de información de terceros. • http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7 http://osvdb.org/78677 http://packetstormsecurity.org/files/view/109210/silverstripecmspage-xss.txt http://secunia.com/advisories/47812 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://www.securityfocus.com/bid/51761 https://exchange.xforce.ibmcloud.com/vulnerabilities/72820 https://github.com/silverstripe/sapphire/commit/252e187 https:/ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •