CVE-2022-4979: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability exists in Sitecore Experience Platform XP 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platfor...

CVE-2023-33652

Sitecore Experience Platform (XP) v9.3 is affected by an authenticated remote code execution (RCE) vulnerability in the /sitecore/shell/Invoke.aspx component. The CVSS 3.1 base score is 8.8 (HIGH) with NETWORK attack vector, LOW exploit complexity, LOW privileges required, and no user interaction...

CVE-2018-7669: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' application is vulnerable to a directory traversal attack, allowing an attacker to access arbitrary files from the host Operating System using a...

PT-2017-16794

Name of the Vulnerable Software and Affected Versions Sitecore CRM version 8.1 Rev 151207 Description The issue allows remote authenticated administrators to read arbitrary files via an absolute path traversal attack. This is achieved by exploiting the file parameter in the...

CVE-2017-5966: Improper Limitation of a Pathname to a Restricted Directory

Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path traversal attack on sitecore/shell/download.aspx with the file parameter...