CVE-2023-49089 Umbraco CMS possible path traversal when creating packages from backoffice

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0...

CVE-2023-48313

Umbraco is an ASP.NET content management system CMS. Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting XSS vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for th...

Cross site scripting

Umbraco is an ASP.NET content management system CMS. Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting XSS vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for th...

CVE-2023-48313 Umbraco contains a DOM-XSS

Umbraco is an ASP.NET content management system CMS. Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting XSS vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for th...

CVE-2023-48313 Umbraco contains a DOM-XSS

Umbraco is an ASP.NET content management system CMS. Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting XSS vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for th...

CVE-2023-48313

Umbraco CMS (ASP.NET) is affected by a DOM-based XSS vulnerability identified as CVE-2023-48313. The issue exists from version 10.0.0 up to but not including 10.8.1 and 12.3.4, where it is mitigated by a patch. Affected component/functionality is not explicitly named in the provided documents bey...

CVE-2023-38694

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain ...

Code injection

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a...

Design/Logic Flaw

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain ...

CVE-2023-48227

CVE-2023-48227 affects Umbraco CMS (Backoffice) where users with only the “send for approval” permission can publish content in certain scenarios. The root cause is an incorrect authorization check in the workflow that does not differentiate between users with publish vs. send-for-approval permis...

CVE-2023-38694 Umbraco CMS vulnerable to possible injection of HTML in an unintended form

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain ...

CVE-2023-49289

Ajax.NET Professional AjaxPro is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package are vulnerable cross site scripting attacks. Releases before version 21.12.22.1 a...

Cross site scripting

Ajax.NET Professional AjaxPro is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package are vulnerable cross site scripting attacks. Releases before version 21.12.22.1 a...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Ajax.NET Professional AjaxPro is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package is vulnerable cross site scripting attacks. Releases before version 21.12.22.1 ar...

CVE-2023-49289

CVE-2023-49289 affects Ajax.NET Professional (AjaxPro) for Microsoft ASP.NET. Affected versions before 21.12.22.1 are vulnerable to Cross-Site Scripting (XSS) through the proxy JavaScript generation mechanism. The vulnerability entails missing input validation/encoding in client-server interactio...

CVE-2023-49289 Cross-site Scripting in Ajax.NET Professional

Ajax.NET Professional AjaxPro is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package are vulnerable cross site scripting attacks. Releases before version 21.12.22.1 a...

dotnet7.0 security update

An update is available for dotnet7.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET is a managed-software framework. It implements a subset of the .NET...

dotnet6.0 security update

An update is available for dotnet6.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET is a managed-software framework. It implements a subset of the .NET...

Oracle Linux 9 : dotnet7.0 (ELSA-2023-7255)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7255 advisory. 7.0.114-1.0.1 - Update to .NET SDK 7.0.114 and Runtime 7.0.14 Tenable has extracted the preceding description block directly from the Oracle Linux...

Oracle Linux 8 : dotnet6.0 (ELSA-2023-7258)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7258 advisory. 6.0.125-1.0.2 - Add strict BuildRequires on 6.0.125-1.0.1 6.0.125-1.0.1 - Update to .NET SDK 6.0.125 and Runtime 6.0.25 Tenable has extracted the...