CVE-2021-40101

アンケートXSSとCSRFの組み合わせにより、Concrete5 8.5.4で管理者アカウントが乗っ取られる 9より前のバージョンのConcrete CMS管理者は、別のユーザーのパスワードを変更する際に自分のパスワードを入力する必要がありませんでした。 CVE-2021-28145（「Concrete...

Concrete CMS Cross-site Scripting via Survey Blocks

Concrete CMS formerly concrete5 before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting XSS attacks via a crafted survey block. This requires at least Editor privileges...

Concrete CMS Cross-Site Scripting Vulnerability

Concrete CMS is an open source content management system CMS for publishing content on the World Wide Web and intranet. A cross-site scripting vulnerability exists in Concrete CMS versions prior to 8.5.5. A remote authenticated user can exploit this vulnerability via a specially crafted survey...

CVE-2021-28145

Concrete CMS formerly concrete5 before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges...

CVE-2021-28145

Concrete CMS formerly concrete5 before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges...

Cross site scripting

Concrete CMS formerly concrete5 before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges...

CVE-2021-28145

Concrete CMS formerly concrete5 before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges...

CVE-2021-28145

Concrete CMS formerly concrete5 before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges...

CVE-2021-28145

Concrete CMS formerly concrete5 before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges...

PT-2021-17771

Name of the Vulnerable Software and Affected Versions: Concrete CMS formerly concrete5 versions prior to 8.5.5 Description: The issue allows remote authenticated users to conduct Cross-site Scripting XSS attacks via a crafted survey block, requiring at least Editor privileges. Recommendations: Fo...

Portlandlabs Concrete5 跨站脚本漏洞

Concrete CMS is an open source content management system CMS for publishing content on the World Wide Web and intranet. A cross-site scripting vulnerability exists in Concrete CMS versions prior to 8.5.5. A remote authenticated user can exploit this vulnerability via a specially crafted survey...

CVE-2021-28145: Improper Neutralization of Input During Web Page Generation

Concrete CMS formerly concrete5 before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges...