CVSS: 9.8EPSS: 80%CPEs: 4EXPL: 2CVE-2023-35813 – Sitecore 8.2 Remote Code Execution
https://notcve.org/view.php?id=CVE-2023-35813
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3. Sitecore version 8.2 suffers from a remote code execution vulnerability. • https://github.com/aalexpereira/CVE-2023-35813 https://github.com/BagheeraAltered/CVE-2023-35813-PoC https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002979 •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2023-33651
https://notcve.org/view.php?id=CVE-2023-33651
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules. • https://blog.assetnote.io/2023/05/10/sitecore-round-two https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925 • CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-33653
https://notcve.org/view.php?id=CVE-2023-33653
Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML. • https://blog.assetnote.io/2023/05/10/sitecore-round-two •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-33652
https://notcve.org/view.php?id=CVE-2023-33652
Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx. • https://blog.assetnote.io/2023/05/10/sitecore-round-two • CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27068
https://notcve.org/view.php?id=CVE-2023-27068
Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx. • https://blogs.night-wolf.io/0-day-vulnerabilities-at-sitecore-pagedesigner https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/103/Sitecore%20Experience%20Platform%20103/Release%20Notes https://www.sitecore.com/products/sitecore-experience-platform • CWE-502: Deserialization of Untrusted Data •