Concretecms

Concrete Cms

119 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.8

CVE-2021-22949

  • EPSS 0.09%
  • Veröffentlicht 23.09.2021 13:15:08
  • Zuletzt bearbeitet 21.11.2024 05:51:00

A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to duplicate files which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security CMS Research Team"

6.5

CVE-2021-22950

  • EPSS 0.1%
  • Veröffentlicht 23.09.2021 13:15:08
  • Zuletzt bearbeitet 21.11.2024 05:51:00

Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar Security Research Team"

7.2

CVE-2021-36766

Exploit
  • EPSS 1.54%
  • Veröffentlicht 30.07.2021 14:15:18
  • Zuletzt bearbeitet 21.11.2024 06:14:03

Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/single_page/dashboard/system/environment/logging.php Logging::update_logging() method. User input passed through the logFile request parameter ...

5.4

CVE-2021-28145

  • EPSS 0.2%
  • Veröffentlicht 18.03.2021 16:15:14
  • Zuletzt bearbeitet 21.11.2024 05:59:10

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.

4.8

CVE-2021-3111

Exploit
  • EPSS 0.61%
  • Veröffentlicht 08.01.2021 15:15:12
  • Zuletzt bearbeitet 21.11.2024 06:20:54

The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.

9

CVE-2020-24986

Exploit
  • EPSS 0.73%
  • Veröffentlicht 04.09.2020 20:15:11
  • Zuletzt bearbeitet 21.11.2024 05:16:22

Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.

9

CVE-2020-11476

Exploit
  • EPSS 1.02%
  • Veröffentlicht 28.07.2020 21:15:14
  • Zuletzt bearbeitet 21.11.2024 04:57:59

Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.

5.3

CVE-2020-14961

  • EPSS 0.34%
  • Veröffentlicht 22.06.2020 00:15:10
  • Zuletzt bearbeitet 21.11.2024 05:04:31

Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.

6.1

CVE-2011-3183

Exploit
  • EPSS 0.33%
  • Veröffentlicht 14.01.2020 21:15:16
  • Zuletzt bearbeitet 21.11.2024 01:29:55

A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.

4.8

CVE-2018-19146

Exploit
  • EPSS 0.39%
  • Veröffentlicht 17.06.2019 20:15:09
  • Zuletzt bearbeitet 21.11.2024 03:57:25

Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT element.