CVE-2020-24794

The CVE-2020-24794 entry covers a Cross-Site Scripting (XSS) flaw in Kentico CMS prior to 12.0.75. The connected CNVD entry attributes the issue to a lack of proper validation of client-side data, enabling an attacker to execute client-side code. Practical impact is XSS exposure on Kentico-hosted...

CVE-2020-24794

Cross Site Scripting XSS vulnerability in Kentico before 12.0.75...

Kentico CMS Installed (Windows)

Binary data kenticocmswininstalled.nbin...

Kentico CMS 9.x < 9.0.51 / 10.x < 10.0.48 Privilege Escalation

A privilege escalation vulnerability exists in Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48. An unauthenticated, remote attacker can exploit this, by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard, to gain administrative access to the CMS. C Tenable...

kentico.mazda.com.my Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1180077 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Kentico Code Issue Vulnerability

Kentico is the United States Kentico company's set of ASP.NET-based content management system CMS. A code issue vulnerability exists in Kentico. An attacker can exploit this vulnerability to execute code on the system with the help of a specially crafted request...

Kentico CMS 12.0.14 Remote Command Execution Exploit

This Metasploit module exploits a vulnerability in the Kentico CMS platform versions 12.0.14 and earlier. Remote command execution is possible via unauthenticated XML requests to the Staging Service SyncServer.asmx interface ProcessSynchronizationTaskData method stagingTaskData parameter. XML inp...

Kentico CMS 12.0.14 Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Kentico CMS Staging SyncServer Unserialize Remote Command Execution', 'Description' = %q This module exploits a vulnerability in the Kentico CMS...

Kentico CMS Staging SyncServer Unserialize Remote Command Execution

This module exploits a vulnerability in the Kentico CMS platform versions 12.0.14 and earlier. Remote Command Execution is possible via unauthenticated XML requests to the Staging Service SyncServer.asmx interface ProcessSynchronizationTaskData method stagingTaskData parameter. XML input is passe...

Kentico CMS 9.x < 10.0.52 / 11.0.x < 11.0.48 / 12.0.x < 12.0.15 Remote Code Execution

Kentico CMS is a common ASP.NET Content Management System CMS used for building websites and online stores. Kentico CMS versions 9 to 10.0.51, 11.0.0 to 11.0.47 and 12.0.0 to 12.0.14 perform unsafe .NET Objects deserialization through the...

Kentico CMS < 9.0.51 Cross-Site Scripting

Kentico CMS is a common ASP.NET Content Management System CMS used for building websites and online stores. Kentico CMS versions before 9.0.51 allow remote attackers to inject arbitrary javascript or HTML content via the CMSBodyClass cookie variable. No source data...

Kentico CMS < 9.0.51 / 10.x < 10.0.48 Access Control Bypass

Kentico CMS is a common ASP.NET Content Management System CMS used for building websites and online stores. Kentico CMS versions before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to gain Global Administrator access by visiting CMSInstall/install.aspx and then browsing the CMS...

Kentico CMS 8.2.x < 8.2.41 Open Redirect

Kentico CMS is a common ASP.NET Content Management System CMS used for building websites and online stores. Kentico CMS versions 8.2.x before 8.2.41 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the link parameter. No source data...

Kentico CMS < 12.0.50 XSS Vulnerability

Kentico CMS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:kentico:kentico...

Kentico Cross-Site Scripting Vulnerability

Kentico is the United States Kentico company's set of ASP.NET-based content management system CMS. A cross-site scripting vulnerability exists in Kentico versions prior to 12.0.50. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can...

CVE-2019-19493

Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS...

CVE-2019-19493

Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS...

Cross site scripting

Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS...

CVE-2019-19493

Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS...

CVE-2019-19493

CVE-2019-19493 affects Kentico CMS prior to 12.0.50. A cross-site scripting (XSS) vulnerability exists where file uploads with a Content-Type header that does not match the file extension can lead to script execution. The issue is described across multiple sources as tied to versions before 12.0....