Silverstripe

Silverstripe

64 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2015-8606

  • EPSS 0.41%
  • Veröffentlicht 13.04.2016 15:59:09
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/secur...

4.3

CVE-2015-5063

Exploit
  • EPSS 0.25%
  • Veröffentlicht 24.06.2015 14:59:05
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework 3.1.13 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter to install.php.

5.8

CVE-2015-5062

Exploit
  • EPSS 0.35%
  • Veröffentlicht 24.06.2015 14:59:04
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter to dev/build.

4.3

CVE-2011-4958

Exploit
  • EPSS 8.81%
  • Veröffentlicht 08.04.2014 14:22:07
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as dem...

5

CVE-2013-6789

Exploit
  • EPSS 0.28%
  • Veröffentlicht 13.11.2013 00:55:03
  • Zuletzt bearbeitet 11.04.2025 00:51:21

security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history, a sim...

5.8

CVE-2013-2653

Exploit
  • EPSS 5.75%
  • Veröffentlicht 13.11.2013 00:55:02
  • Zuletzt bearbeitet 11.04.2025 00:51:21

security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote attackers to conduct phishing attacks without detection by the victim.

4.3

CVE-2012-6458

  • EPSS 0.23%
  • Veröffentlicht 09.08.2013 22:55:03
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Multiple cross-site scripting (XSS) vulnerabilities in the SilverStripe e-commerce module 3.0 for SilverStripe CMS allow remote attackers to inject arbitrary web script or HTML via the (1) FirstName, (2) Surname, or (3) Email parameter to code/forms/...

4.3

CVE-2012-4968

Exploit
  • EPSS 0.3%
  • Veröffentlicht 17.09.2012 17:55:03
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted string to the AbsoluteLinks, (2) BigSummary, (3) ContextSum...

5

CVE-2010-5079

  • EPSS 0.62%
  • Veröffentlicht 17.09.2012 17:55:02
  • Zuletzt bearbeitet 11.04.2025 00:51:21

SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) autologin, (3) "forgot password" functionality, and (4) password salts, which makes it easier for remote attac...

4.3

CVE-2010-4822

Exploit
  • EPSS 0.59%
  • Veröffentlicht 17.09.2012 17:55:02
  • Zuletzt bearbeitet 11.04.2025 00:51:21

core/model/MySQLDatabase.php in SilverStripe 2.4.x before 2.4.4, when the site is running in "live mode," allows remote attackers to obtain the SQL queries for a page via the showqueries and ajax parameters.