CVSS: 5.3EPSS: 2%CPEs: 2EXPL: 1CVE-2019-14280 – Craft CMS 2.7.9/3.2.5 - Information Disclosure
https://notcve.org/view.php?id=CVE-2019-14280
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public. En algunas circunstancias, Craft versiones 2 anteriores a 2.7.10 y versiones 3 anteriores a 3.2.6, no estaba eliminando los datos EXIF ??de las imágenes subidas por el usuario cuando estaba configurado para hacerlo, lo que expone potencialmente al público los datos personales y de geolocalización. Craft CMS versions 2.7.9 and 3.2.5 suffers from an information disclosure vulnerability. • https://www.exploit-db.com/exploits/47343 http://packetstormsecurity.com/files/154276/Craft-CMS-2.7.9-3.2.5-Information-Disclosure.html https://github.com/craftcms/cms/blob/develop-v2/CHANGELOG-v2.md#2710---2019-07-24 https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#326---2019-07-23 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12823
https://notcve.org/view.php?id=CVE-2019-12823
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. Craft CMS antes de la versión 3.1.31 no filtra correctamente los feeds XML y por lo tanto permite XSS • https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md https://github.com/craftcms/cms/commit/6432eca59b93bcea2ca2616199e5d419447e613f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2019-9554 – Craft CMS 3.1.12 Pro - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-9554
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI. En la versión 3.1.12 Pro de Craft CMS, se descubrió una vulnerabilidad de tipo XSS en el campo de inserción del encabezado cuando se agrega el código fuente en un URI s/admin/entries/news/new. Craft CMS version 3.1.12 Pro suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/46496 https://packetstormsecurity.com/files/151944/Craft-CMS-3.1.12-Pro-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20465
https://notcve.org/view.php?id=CVE-2018-20465
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field. Craft CMS, hasta la versión 3.0.34, permite que administradores autenticados remotos lean información sensible mediante una inyección de plantillas del lado del servidor, tal y como queda demostrado con una cadena {% para craft.app.config.DB.user y craft.app.config.DB.password en el formato de URI de las opciones del sitio, lo que provoca que se muestren el nombre de usuario y la contraseña en texto claro en un campo URI. • https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md https://github.com/phuctam/Server-Side-Template-Injection-in-CraftCMS-/issues/1 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 3CVE-2018-20418 – Craft CMS 3.0.25 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-20418
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab. index.php?p=admin/actions/entries/save-entry en Craft CMS 3.0.25 permite Cross-Site Scripting (XSS) mediante el guardado de un nuevo título de la pestaña de la consola. Craft CMS version 3.0.25 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/46054 https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md https://github.com/rdincel1/Craft-CMS-3.0.25---Cross-Site-Scripting https://www.raifberkaydincel.com/craft-cms-3-0-25-cross-site-scripting-vulnerability.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •