CVE-2020-9471

Umbraco Cloud 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Packages functionality...

Design/Logic Flaw

Umbraco Cloud 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Packages functionality...

Design/Logic Flaw

Umbraco CMS 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Package functionality...

CVE-2020-9472

CVE-2020-9472 affects Umbraco CMS 8.5.3. The authenticated user can upload files via the Install Package functionality, which can lead to Remote Code Execution. The vulnerability is evidenced by the CVE description and corroborated across multiple sources in the connected documents (e.g., GHSA/OS...

CVE-2020-9472

Umbraco CMS 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Package functionality...

CVE-2020-9471

The CVE-2020-9471 entry concerns Umbraco Cloud 8.5.3, where an authenticated user with package-install permissions can upload arbitrary files via the Install Packages feature, leading to Remote Code Execution. The vulnerability is tied to the authenticated file upload path in Umbraco Cloud’s Inst...

CVE-2020-9471

Umbraco Cloud 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Packages functionality...

Umbraco CMS Cross-Site Request Forgery Vulnerability (CNVD-2020-04832)

Umbraco CMS is a Danish Umbraco company using ASP.Net build , Mysql for data storage content management system CMS. The system supports customizing templates , manage users , rights definition of content and so on. A cross-site request forgery vulnerability exists in Umbraco CMS. An attacker is...

CVE-2020-7210

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...

CVE-2020-7210

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...

Cross site request forgery (csrf)

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...

CVE-2020-7210

CVE-2020-7210 affects Umbraco CMS 8.2.2, where a CSRF flaw allows an attacker to enable/disable or delete user accounts. The Red Hat, GHSA, NVD, and Snyk records confirm the same issue across multiple mappings; exploit details are not provided beyond the CSRF risk. The practical impact is the man...

CVE-2020-7210

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...

Umbraco CMS 8.2.2 Cross Site Request Forgery

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Cross-Site Request Forgery CSRF product: Umbraco CMS vulnerable version: version 8.2.2 fixed version: version 8.5 CVE number: CVE-2020-7210 impact: medium homepage:...

CVE-2019-13957

In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...

CVE-2019-13957

In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...

Sql injection

In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...

CVE-2019-13957

CVE-2019-13957 affects Umbraco 7.3.8 with a SQL Injection vulnerability in the backoffice /PageWApprove/PageWApproveApi/GetInpectSearch endpoint via the nodeName parameter. The NVD entry lists high/critical impact metrics (CVSS v2 base score 7.5; CVSS v3.1 base score 9.8) indicating network attac...

CVE-2019-13957

In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...

Cross-site Scripting (XSS)

umbraco cms is vulnerable to cross-site scripting. A remotely authenticated attacker is able to inject arbitrary Javascript into a victim's browser via the Header Name when updating or removing public access of content...