CVE-2018-19453

Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type...

CVE-2018-19453

CVE-2018-19453 affects Kentico CMS prior to 11.0.45. The issue is an unrestricted upload vulnerability that allows uploading a file with a dangerous type, enabling potential follow-on attacks (e.g., XSS or CORS) as described in the connected Nessus/OpenVAS/NVD entries. Affected versions are Kenti...

PT-2019-9820

Name of the Vulnerable Software and Affected Versions Kentico CMS versions prior to 11.0.45 Description The issue allows for the unrestricted upload of a file with a dangerous type. Recommendations For versions prior to 11.0.45, update to version 11.0.45 or later to resolve the issue...

CVE-2018-19453: Unrestricted Upload of File with Dangerous Type

Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type...

Kentico CMS <= 12.0.14 RCE Vulnerability

Kentico CMS is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2019-10068

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to...

Deserialization of untrusted data

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to...

CVE-2019-10068

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to...

CVE-2019-10068

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to...

CVE-2019-10068

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to...

CVE-2019-10068

Kentico CMS is affected by a remote code execution vulnerability (CVE-2019-10068) due to insecure .NET object deserialization during staging service processing. Affected versions include Kentico 12.0.x before 12.0.15, 11.x before 11.0.48, 10.x before 10.0.52, and 9.x. The issue can be triggered v...

PT-2019-11415

Name of the Vulnerable Software and Affected Versions: Kentico Xperience versions 9.x and earlier Kentico Xperience versions 10.0.x through 10.0.51 Kentico Xperience versions 11.0.x through 11.0.47 Kentico Xperience versions 12.0.x through 12.0.14 Description: The issue is related to the...

CVE-2019-10068

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to...

CVE-2019-10068: Deserialization of Untrusted Data

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to...

CVE-2019-6242

Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time...

Design/Logic Flaw

DISPUTED Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time...

CVE-2019-6242

Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time...

CVE-2019-6242

Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time...

CVE-2019-6242

Kentico CMS v10.0.42 exposes the cleartext SMTP password on the SMTP configuration page. The issue allows Global Administrators to read the stored SMTP credentials (root cause is access to configuration data containing credentials). Impact is exposure of sensitive SMTP credentials to high-privile...

PT-2019-18047 · Kentico · Kentico

Name of the Vulnerable Software and Affected Versions: Kentico version 10.0.42 Description: The issue allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. The vendor considers this a best-practice violation but not a vulnerability. The...