molecaten.nl Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-952988 Security Researcher yougina Helped patch 6 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting molecaten.nl website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO...

Remote Code Execution (RCE)

kentico is vulnerable to remote code execution RCE. Failure to validate security headers allow an attacker to bypass authentication and perform unsafe deserialization using a malicious .NET object input, which would lead to remote code execution on the server...

CVE-2019-12102

Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions...

CVE-2019-12102

Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions...

Information disclosure

DISPUTED Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissio...

CVE-2019-12102

CVE-2019-12102 affects Kentico 11–12. The issue allows unauthenticated uploading and browsing of files via cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs_media.aspx. Root cause appears to be media library permissions/configuration, with vendor notes that by default all...

CVE-2019-12102

Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions...

CVE-2019-12102

Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions...

Kentico Design Vulnerability

Kentico is the United States Kentico company's set of ASP.NET-based content management system CMS. Kentico versions 11 through 12 allow attackers to upload and browse files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx URI...

PT-2019-12641 · Kentico · Kentico

Name of the Vulnerable Software and Affected Versions: Kentico versions 11 through 12 Description: The issue allows attackers to upload and explore files without authentication via the "cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs media.aspx" URI. However, the vendor...

Kentico CMS < 11.0.45 File Upload Vulnerability

Kentico CMS allows unrestricted upload of a file with a dangerous type. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2018-19453

Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type...

CVE-2018-19453

Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type...

Unrestricted file upload

Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type...

CVE-2018-19453

Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type...

CVE-2018-19453

CVE-2018-19453 affects Kentico CMS prior to 11.0.45. The issue is an unrestricted upload vulnerability that allows uploading a file with a dangerous type, enabling potential follow-on attacks (e.g., XSS or CORS) as described in the connected Nessus/OpenVAS/NVD entries. Affected versions are Kenti...

PT-2019-9820

Name of the Vulnerable Software and Affected Versions Kentico CMS versions prior to 11.0.45 Description The issue allows for the unrestricted upload of a file with a dangerous type. Recommendations For versions prior to 11.0.45, update to version 11.0.45 or later to resolve the issue...

Kentico CMS <= 12.0.14 RCE Vulnerability

Kentico CMS is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2019-10068

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to...

Deserialization of untrusted data

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to...