651 matches found
CVE-2018-6842
Kentico CMS is affected by CVE-2018-6842: XSS due to improper construction/validation when crafting a URL. Affected versions are Kentico 10.x before 10.0.50 and 11.x before 11.0.3. Impact is client-side script execution in authenticated/selected contexts via crafted URLs. Remediation per document...
CVE-2018-6842
Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page...
CVE-2018-6843
CVE-2018-6843 affects Kentico CMS: versions prior to 10.0.50 and prior to 11.0.3 expose an SQL injection in the administration interface due to unsafe construction/validation of user input. The vulnerability can allow manipulation or disclosure of data via the back-end database when accessed thro...
CVE-2018-6843
Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface...
CVE-2018-6843
Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface...
CVE-2018-6842: Improper Neutralization of Input During Web Page Generation
Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page...
PT-2018-17770
Name of the Vulnerable Software and Affected Versions Kentico versions prior to 10.0.50 Kentico versions 11.0.0 through 11.0.2 Description The issue allows for cross-site scripting XSS due to improper construction of a system page when a crafted URL is used. Recommendations For Kentico versions...
CVE-2018-6843: Improper Neutralization of Special Elements used in an SQL Command
Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface...
PT-2018-17771
Name of the Vulnerable Software and Affected Versions Kentico versions prior to 10.0.50 Kentico versions prior to 11.0.3 Description The administration interface of Kentico has SQL injection. Recommendations For Kentico versions prior to 10.0.50, update to version 10.0.50 or later. For Kentico...
Kentico CMS Arbitrary Code Execution Vulnerability
Kentico CMS is an enterprise-grade web content management system and customer experience management system. An arbitrary code execution vulnerability exists in Kentico CMS versions 9 through 11, which can be exploited by an authenticated, remote attacker to edit and update ascx code...
Kentico CMS Cross-Site Scripting Vulnerability
Kentico CMS is an enterprise-grade web content management system and customer experience management system. A cross-site scripting vulnerability exists in Kentico CMS versions 9 through 11, which can be exploited by an attacker to inject arbitrary web script or HTML...
CVE-2018-7205
Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages - Edit template properties - Device Layouts - Create devic...
Remote code execution
DISPUTED Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C code in a "Pages - Edit - Template - Edit template properties - Layout" box. NOTE: the vendor ha...
CVE-2018-7205
Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages - Edit template properties - Device Layouts - Create devic...
CVE-2018-7046
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C code in a "Pages - Edit - Template - Edit template properties - Layout" box. NOTE: the vendor has respond...
CVE-2018-7046
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C code in a "Pages - Edit - Template - Edit template properties - Layout" box. NOTE: the vendor has respond...
CVE-2018-7046
CVE-2018-7046 affects Kentico CMS versions 9–11. An authenticated remote attacker can execute arbitrary OS commands through a dynamic .NET code evaluation context created by C# code entered in the “Pages → Edit → Template → Edit template properties → Layout” box. The vendor notes this functionali...
CVE-2018-7205
Kentico CMS versions 9–11 are affected by a reflected cross-site scripting (XSS) vulnerability in the Design/Device Layout feature (Edit device layout). The issue allows remote attackers to inject and execute arbitrary JavaScript via a malicious devicename parameter in links created through Pages...
CVE-2018-7046
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C code in a "Pages - Edit - Template - Edit template properties - Layout" box. NOTE: the vendor has respond...
CVE-2018-7205
Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages - Edit template properties - Device Layouts - Create devic...