CVE-2023-2341

CVE-2023-2341 affects pimcore/pimcore prior to 10.5.21 with a Cross-site Scripting (XSS) vulnerability in the admin/login flow (noted in multiple sources). The root cause is an XSS flaw in the Pimcore admin login path, exploitable by crafting a URL or input that injects JavaScript. A fix is avail...

CVE-2023-2336

CVE-2023-2336 concerns Pimcore Pimcore prior to 10.5.21 with a path traversal vulnerability in the importServerFilesAction of AssetController.php. The issue allows an authenticated or network attacker to read files outside the web root, enabling arbitrary file reads. A fix is available in Pimcore...

CVE-2023-2338 SQL Injection in pimcore/pimcore

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2023-2328 Cross-site Scripting (XSS) - Generic in pimcore/pimcore

Cross-site Scripting XSS - Generic in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2023-2338 SQL Injection in pimcore/pimcore

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2023-2342 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting XSS - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2023-2342 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting XSS - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2023-2328 Cross-site Scripting (XSS) - Generic in pimcore/pimcore

Cross-site Scripting XSS - Generic in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2023-2323 Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting XSS - Stored in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2023-2342 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting XSS - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2023-2259

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304...

Authorization

Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304...

Input validation

Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304...

Input validation

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304...

CVE-2023-2251

Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5...

CVE-2023-2251

Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5...

Code injection

Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5...

CVE-2023-2260 Authorization Bypass Through User-Controlled Key in alfio-event/alf.io

Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304...

CVE-2023-2259 Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304...

CVE-2023-2258 Improper Neutralization of Formula Elements in a CSV File in alfio-event/alf.io

Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304...