CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1CVE-2023-46906
https://notcve.org/view.php?id=CVE-2023-46906
juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated. juzaweb <= 3.4 es vulnerable a un control de acceso incorrecto, lo que provoca una interrupción de la aplicación después de un código de estado HTTP 500. El payload en el campo de timezone no se validó correctamente. • https://github.com/juzaweb/cms https://www.sumor.top/index.php/archives/880 •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-46467
https://notcve.org/view.php?id=CVE-2023-46467
Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page. Vulnerabilidad de Cross-Site Scripting (XSS) en juzawebCMS v.3.4 y anteriores permite a un atacante remoto ejecutar código arbitrario a través de un payload manipulado en el parámetro de nombre de usuario de la página de registro. • https://www.sumor.top/index.php/archives/872 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11198
https://notcve.org/view.php?id=CVE-2019-11198
Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4) I#316995 - Icon Selection module, (5) #317000 - Latitude field, (6) #317000 - Longitude field, (7) #317017 - UploadPackage2.aspx module, (8) #317072 - Context menu, or (9) I#317073 - Insert from Template dialog. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en CMS de Sitecore versión 9.0.1 y anteriores, permiten a los atacantes remotos inyectar script web o HTML arbitrario por medio de (1) #300583 - Módulo List Manager Dashboard, (2) #307638 - Módulo Campaign Creator, (3) #316994 - Campo Attributes, (4) I#316995 - Módulo Icon Selection, (5) #317000 - Campo Latitude, (6) #317000 - Campo Longitude, (7) #317017 - Módulo UploadPackage2.aspx, ( 8) #317072 - Menú Context, o (9) I#317073 - Insertar desde el cuadro de diálogo Template. • https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/92/Sitecore%20Experience%20Platform%2092%20Initial%20Release/Release%20Notes https://outpost24.com/blog • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 1CVE-2019-9875
https://notcve.org/view.php?id=CVE-2019-9875
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter. La deserialización de datos no confiables en el módulo anti CSRF en Sitecore hasta la versón 9.1, permite a un atacante identificado ejecutar código arbitrario mediante el envío un objeto .NET serializado dentro de un parámetro POST de HTTP. • https://dev.sitecore.net/Downloads.aspx https://www.synacktiv.com/blog.html https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf • CWE-502: Deserialization of Untrusted Data •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2014-100004
https://notcve.org/view.php?id=CVE-2014-100004
Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI. NOTE: some of these details are obtained from third party information. Vulnerabilidad de XSS en Sitecore CMS anterior a 7.0 actualización-4 (rev. 140120) permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro xmlcontrol en la URI por defecto. NOTA: algunos de estos detalles se obtienen de información de terceras partes. • http://osvdb.org/102660 http://secunia.com/advisories/56705 http://sitecorekh.blogspot.dk/2014/01/sitecore-releases-70-update-4-rev-140120.html http://www.securityfocus.com/archive/1/530901/100/0/threaded http://www.securityfocus.com/bid/65254 https://exchange.xforce.ibmcloud.com/vulnerabilities/90833 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •