CVSS: 10.0EPSS: 93%CPEs: 4EXPL: 3CVE-2023-35813 – Sitecore 8.2 Remote Code Execution
https://notcve.org/view.php?id=CVE-2023-35813
17 Jun 2023 — Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3. Sitecore version 8.2 suffers from a remote code execution vulnerability. • https://packetstorm.news/files/id/177524 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2023-33651
https://notcve.org/view.php?id=CVE-2023-33651
06 Jun 2023 — An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules. • https://blog.assetnote.io/2023/05/10/sitecore-round-two • CWE-863: Incorrect Authorization •
CVSS: 9.0EPSS: 2%CPEs: 1EXPL: 1CVE-2023-33652
https://notcve.org/view.php?id=CVE-2023-33652
06 Jun 2023 — Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx. • https://blog.assetnote.io/2023/05/10/sitecore-round-two • CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') •
CVSS: 9.0EPSS: 2%CPEs: 1EXPL: 1CVE-2023-33653
https://notcve.org/view.php?id=CVE-2023-33653
06 Jun 2023 — Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML. • https://blog.assetnote.io/2023/05/10/sitecore-round-two •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 1CVE-2023-27068
https://notcve.org/view.php?id=CVE-2023-27068
23 May 2023 — Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx. • https://blogs.night-wolf.io/0-day-vulnerabilities-at-sitecore-pagedesigner • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27066
https://notcve.org/view.php?id=CVE-2023-27066
22 May 2023 — Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle. • https://blogs.night-wolf.io/0-day-vulnerabilities-at-sitecore-pagedesigner • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27067
https://notcve.org/view.php?id=CVE-2023-27067
22 May 2023 — Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx • https://blogs.night-wolf.io/0-day-vulnerabilities-at-sitecore-pagedesigner • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.3EPSS: 7%CPEs: 2EXPL: 1CVE-2023-26262
https://notcve.org/view.php?id=CVE-2023-26262
14 Mar 2023 — An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server. • https://github.com/istern/CVE-2023-26262 • CWE-434: Unrestricted Upload of File with Dangerous Type •