CVE-2015-7822

CVE-2015-7822 is a real vulnerability in Kentico CMS 8.2 with multiple cross-site scripting (XSS) flaws. The root cause is improper validation of user-supplied input, enabling an attacker to inject script via (1) the UIPage.aspx parameter name and (2) the CMSBodyClass cookie, potentially executed...

PT-2015-7632

Name of the Vulnerable Software and Affected Versions Kentico CMS versions 8.2 through 8.2.41 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the link parameter in the CMSPages/GetDocLink.ashx endpoint. Recommendatio...

CVE-2015-7823: Undefined Security Weakness

Open redirect vulnerability in CMSPages/GetDocLink.ashx in Kentico CMS 8.2 through 8.2.41 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the link parameter...

CVE-2015-7822: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Kentico CMS 8.2 allow remote attackers to inject arbitrary web script or HTML via a 1 parameter name to CMSModules/AdminControls/Pages/UIPage.aspx or the 2 CMSBodyClass cookie variable to the default URI...

PT-2015-7631

Name of the Vulnerable Software and Affected Versions Kentico CMS version 8.2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via a parameter name to...

Kentico CMS 8.2 Cross Site Scripting / Open Redirect

Web application Kentico CMS 8.2 XSS / Open Redirection The CVE-2015-7823 reference is still waiting my disclosure. The exploit works on 8.2 to 8.2.41 I've contacted the vendor and he fixed the vulnerability in the next major version Vulnerability type: Reflected XSS High The elementguid variable ...

Kentico CMS 8.2.x Multiple Vulnerabilities

Kentico is the only fully integrated ASP.NET CMS, E-commerce, and Online Marketing platform that allows you to create cutting-edge websites, and fully optimize your digital customers’ experiences across multiple channels. Vulnerability type: Reflected XSS High The elementguid variable is vulnerab...

Kentico CMS 7.0.75 - User Information Disclosure

No description provided by source. Exploit Title: Kentico CMS User Enumeration Bug Google Dork: inurl:/CMSPages/logon.aspx -- enumerates several Kentico CMS sites Date: 02-25-2014 Exploit Author: Charlie Campbell and Lyndon Mendoza Vendor Homepage: http://www.kentico.com/ Software Link:...

Kentico CMS用户名泄漏漏洞

Kentico CMS是一款内容管理系统。 由于应用程序没有限制访问CMSModules/Messaging/CMSPages/PublicMessageUserSelector.aspx，可以泄漏有效的用户名。 0 Kentico CMS 7.x Kentico CMS 7.0.78版本以修复此漏洞，建议用户下载使用： http://www.kentico.com/...

Kentico CMS 7.0.75 - User Information Disclosure

Kentico CMS 7.0.75 - User Information Disclosure Exploit Title: Kentico CMS User Enumeration Bug Google Dork: inurl:/CMSPages/logon.aspx -- enumerates several Kentico CMS sites Date: 02-25-2014 Exploit Author: Charlie Campbell and Lyndon Mendoza Vendor Homepage: http://www.kentico.com/ Software...

Kentico CMS 7.0.75 - User Information Disclosure

Exploit for asp platform in category web applications This vulnerability is an unprotected page on the site where you can view all current users and usernames. To find out if a Kentico CMS is vulnerable go to http://site.com/CMSModules/Messaging/CMSPages/PublicMessageUserSelector.aspx assuming th...

Kentico CMS 7.0.75 - User Information Disclosure

Exploit Title: Kentico CMS User Enumeration Bug Google Dork: inurl:/CMSPages/logon.aspx -- enumerates several Kentico CMS sites Date: 02-25-2014 Exploit Author: Charlie Campbell and Lyndon Mendoza Vendor Homepage: http://www.kentico.com/ Software Link:...

Kentico CMS 7.0.75 User Enumeration

Exploit Title: Kentico CMS User Enumeration Bug Google Dork: inurl:/CMSPages/logon.aspx -- enumerates several Kentico CMS sites Date: 02-25-2014 Exploit Author: Charlie Campbell and Lyndon Mendoza Vendor Homepage: http://www.kentico.com/ Software Link:...

Kentico CMS 5.5R2.23 - userContextMenu_Parameter Cross-Site Scripting

Kentico CMS 5.5R2.23 - userContextMenuParameter Cross-Site Scripting source: https://www.securityfocus.com/bid/48051/info Kentico CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...

Kentico CMS 5.5R2.23 Cross Site Scripting

Kentico CMS =5.5R2.23 Cross-Site Scripting POST Injection Vulnerability Vendor: Kentico Software Product web page: http://www.kentico.com Affected version: 5.5R2.23 and bellow Summary: .NET Web Content Management System for ASP.NET Desc: Kentico CMS suffers from a XSS vulnerability when parsing...

Kentico CMS 5.5R2.23 - 'userContextMenu_Parameter' Cross-Site Scripting

source: https://www.securityfocus.com/bid/48051/info Kentico CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the contex...

Kentico CMS <=5.5R2.23 Cross-Site Scripting POST Injection Vulnerability

Summary .NET Web Content Management System for ASP.NET. Description Kentico CMS suffers from a XSS vulnerability when parsing user input to the 'userContextMenuparameter' parameter via POST method in '/examples/webparts/membership/users-viewer.aspx'. Attackers can exploit this weakness to execute...