CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2017-5197
https://notcve.org/view.php?id=CVE-2017-5197
There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element. Hay una XSS en SilverStripe CMS en versiones anteriores a 3.4.4 y 3.5.x en versiones anteriores a 3.5.2. El vector de ataque es un nombre de página. • http://www.securityfocus.com/bid/96572 https://www.silverstripe.org/download/security-releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2015-8606
https://notcve.org/view.php?id=CVE-2015-8606
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm. Múltiples vulnerabilidades de XSS en SilverStripe CMS & Framework en versiones anteriores a 3.1.16 y 3.2.x en versiones anteriores a 3.2.1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) Locale o (2) FailedLogenCount en admen/security/EditForm/field/Members/item/new/ItemEditForm. • http://seclists.org/fulldisclosure/2015/Dec/55 http://www.openwall.com/lists/oss-security/2015/12/17/1 http://www.openwall.com/lists/oss-security/2015/12/17/11 http://www.openwall.com/lists/oss-security/2015/12/18/5 http://www.silverstripe.org/download/security-releases/ss-2015-026 https://cybersecurityworks.com/zerodays/cve-2015-8606-silverstripe.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 5CVE-2011-4958 – SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2011-4958
Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as demonstrated by a request to (1) admin/reports/, (2) admin/comments/, (3) admin/, (4) admin/show/, (5) admin/assets/, and (6) admin/security/. Vulnerabilidad de XSS en la función de proceso en SSViewer.php en SilverStripe anterior a 2.3.13 y 2.4.x anterior a 2.4.6 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de QUERY_STRING hacia marcadores de posición de plantillas, tal y como fue demostrado por una solicitud hacia (1) admin/reports/, (2) admin/comments/, (3) admin/, (4) admin/show/, (5) admin/assets/ y (6) admin/security/. • https://www.exploit-db.com/exploits/36226 http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12 http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6 http://osvdb.org/76258 http://secunia.com/advisories/46390 http://www.rul3z.de/advisories/SSCHADV2011-024.txt http://www.securityfocus.com/archive/1/520050/100/0/threaded https://github.com/silverstripe/sapphire/commit/16c3235 https://github.com/silverstripe/sapphire/commit/52a895f https://github.com/silve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2012-6458
https://notcve.org/view.php?id=CVE-2012-6458
Multiple cross-site scripting (XSS) vulnerabilities in the SilverStripe e-commerce module 3.0 for SilverStripe CMS allow remote attackers to inject arbitrary web script or HTML via the (1) FirstName, (2) Surname, or (3) Email parameter to code/forms/OrderFormAddress.php; or the (4) FirstName or (5) Surname parameter to code/forms/ShopAccountForm.php. Múltiples vulnerabilidades de cross-site scripting (XSS) en el módulo SilverStripe e-commerce v3.0 para SilverStripe CMS, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de los parámetros (1) FirstName, (2) Surname, o (3) Email en code/forms/OrderFormAddress.php; o los parámetros (4) FirstName o (5) Surname en code/forms/ShopAccountForm.php. • http://archives.neohapsis.com/archives/bugtraq/2013-07/0090.html https://code.google.com/p/silverstripe-ecommerce/source/detail?r=3739 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 14EXPL: 0CVE-2010-5078
https://notcve.org/view.php?id=CVE-2010-5078
SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain version information via a direct request to (1) apphire/silverstripe_version or (2) cms/silverstripe_version. SilverStripe v2.3.x antes de v2.3.10 y v2.4.x antes de v2.4.4 almacena información sensible bajo la raíz web con controles de acceso insuficientes, lo que permite a atacantes remotos obtener información de la versión a través de una petición directa a (1) apphire/silverstripe_version ó (2) cms/silverstripe_version. • http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10 http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4 http://open.silverstripe.org/ticket/5031 http://secunia.com/advisories/42346 http://www.openwall.com/lists/oss-security/2011/01/03/12 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://www.os • CWE-264: Permissions, Privileges, and Access Controls •