CVE-2020-5811

An authenticated path traversal vulnerability exists during package installation in Umbraco CMS = 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package...

Umbraco 跨站脚本漏洞

Umbraco is an open source content management system CMS based on ASP.NET technology. Umbraco 8.9.1 and earlier versions are vulnerable to a stored cross-site scripting vulnerability. An attacker can exploit this vulnerability by uploading a malicious .svg file to conduct a cross-site scripting...

Umbraco 安全漏洞

Umbraco is an open source content management system CMS based on ASP.NET technology. An improper access control vulnerability exists in Editors/LogViewerController.cs in Umbraco 8.9.1 and earlier versions. Users without the Applications.Settings access privilege can exploit the vulnerability to...

CVE-2020-9472

Umbraco CMS 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Package functionality...

CVE-2020-9472

Umbraco CMS 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Package functionality...

CVE-2020-9472

Umbraco CMS 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Package functionality...

Design/Logic Flaw

Umbraco CMS 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Package functionality...

CVE-2020-9472

Umbraco CMS 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Package functionality...

Umbraco CMS Cross-Site Request Forgery Vulnerability (CNVD-2020-04832)

Umbraco CMS is a Danish Umbraco company using ASP.Net build , Mysql for data storage content management system CMS. The system supports customizing templates , manage users , rights definition of content and so on. A cross-site request forgery vulnerability exists in Umbraco CMS. An attacker is...

CVE-2020-7210

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...

CVE-2020-7210

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...

CVE-2020-7210

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...

Cross site request forgery (csrf)

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...

CVE-2020-7210

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...

CVE-2020-7210

CVE-2020-7210 affects Umbraco CMS 8.2.2, where a CSRF flaw allows an attacker to enable/disable or delete user accounts. The Red Hat, GHSA, NVD, and Snyk records confirm the same issue across multiple mappings; exploit details are not provided beyond the CSRF risk. The practical impact is the man...

Umbraco CMS 8.2.2 Cross Site Request Forgery

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Cross-Site Request Forgery CSRF product: Umbraco CMS vulnerable version: version 8.2.2 fixed version: version 8.5 CVE number: CVE-2020-7210 impact: medium homepage:...

Cross-site Scripting (XSS)

umbraco cms is vulnerable to cross-site scripting. A remotely authenticated attacker is able to inject arbitrary Javascript into a victim's browser via the Header Name when updating or removing public access of content...

Cross-site Scripting (XSS)

umbraco cms is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the nodename parameter during the creation of a new page related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and...

XML External Entity (XXE)

umbraco cms is vulnerable to XML external entity XXE attacks. Lack of validation and permitting of external DTDs allow attackers to obtain confidential information via an SSRF from the XXE attack...

Umbraco CMS 7.12.4 - (Authenticated) Remote Code Execution

Umbraco CMS 7.12.4 - Authenticated Remote Code Execution Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators Dork: N/A Date: 2019-01-13 Exploit Author: Gregory DRAPERI & Hugo BOUTINON Vendor Homepage: http://www.umbraco.com/ Software Link:...