Pimcore

Pimcore

143 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2021-39166

  • EPSS 0.78%
  • Veröffentlicht 01.09.2021 14:15:07
  • Zuletzt bearbeitet 21.11.2024 06:18:46

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is...

8.8

CVE-2021-37702

  • EPSS 1.06%
  • Veröffentlicht 18.08.2021 15:15:07
  • Zuletzt bearbeitet 21.11.2024 06:15:44

Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround.

7.5

CVE-2021-31869

Exploit
  • EPSS 1.08%
  • Veröffentlicht 04.08.2021 23:15:07
  • Zuletzt bearbeitet 06.03.2026 19:53:00

Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application. This issue was fixed in version 6.9.4 of the product.

8.8

CVE-2021-23405

Exploit
  • EPSS 1.72%
  • Veröffentlicht 09.07.2021 13:15:07
  • Zuletzt bearbeitet 21.11.2024 05:51:39

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.

7.1

CVE-2021-23340

Exploit
  • EPSS 1.32%
  • Veröffentlicht 18.02.2021 15:15:14
  • Zuletzt bearbeitet 21.11.2024 05:51:32

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authentic...

6.5

CVE-2020-26246

  • EPSS 0.8%
  • Veröffentlicht 03.12.2020 01:15:10
  • Zuletzt bearbeitet 21.11.2024 05:19:38

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions.

7.2

CVE-2020-7759

  • EPSS 1.36%
  • Veröffentlicht 30.10.2020 11:15:12
  • Zuletzt bearbeitet 21.11.2024 05:37:44

The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter ...

6.5

CVE-2019-10763

  • EPSS 0.87%
  • Veröffentlicht 18.11.2019 20:15:11
  • Zuletzt bearbeitet 21.11.2024 04:19:52

pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 't...

7.5

CVE-2019-18986

  • EPSS 1.19%
  • Veröffentlicht 15.11.2019 05:15:13
  • Zuletzt bearbeitet 21.11.2024 04:33:56

Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.

9.8

CVE-2019-18981

  • EPSS 1.39%
  • Veröffentlicht 15.11.2019 05:15:12
  • Zuletzt bearbeitet 21.11.2024 04:33:55

Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.