Page 7 of 53 results (0.053 seconds)

CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2023-28477

https://notcve.org/view.php?id=CVE-2023-28477

Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter. • https://concretecms.com https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2023-28821

https://notcve.org/view.php?id=CVE-2023-28821

Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets. • https://github.com/concretecms/concretecms/releases https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2023-28471

https://notcve.org/view.php?id=CVE-2023-28471

Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name. • https://concretecms.com https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2023-28472

https://notcve.org/view.php?id=CVE-2023-28472

Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies. • https://concretecms.com https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 •

CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2023-28473

https://notcve.org/view.php?id=CVE-2023-28473

Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section. • https://concretecms.com https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 • CWE-287: Improper Authentication •