CVE-2023-32312

The CVE-2023-32312 entry concerns UmbracoIdentityExtensions, an Umbraco add-on for ASP.NET Identity integration. Affected versions expose endpoints to untrusted actors because client secrets are not required, enabling unsafe use of the implicit flow in non-SPA/multi-page scenarios. The root cause...

CVE-2023-32312 Client secret not mandatory in UmbracoIdentityExtensions

UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit fl...

PT-2023-23722 · Umbraco · Umbracoidentityextensions

Name of the Vulnerable Software and Affected Versions: UmbracoIdentityExtensions versions affected versions not specified Description: The issue concerns the UmbracoIdentityExtensions package, which is an Umbraco add-on for ASP.Net Identity integration. In affected versions, client secrets are no...

CVE-2019-25137

Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx...

CVE-2019-25137

Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx...

Remote code execution

Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx...

CVE-2019-25137

Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx...

CVE-2019-25137

Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx...

PT-2023-11364 · Umbraco · Umbraco Cms

Name of the Vulnerable Software and Affected Versions: Umbraco CMS versions 4.11.8 through 7.15.10 Umbraco CMS version 7.12.4 Description: The issue allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to "developer/Xslt/xsltVisualize.aspx"...

CVE-2019-25137

CVE-2019-25137 affects Umbraco CMS versions 4.11.8–7.15.10 and 7.12.4. The issue enables Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx. No fixed version is published; remediation guidance varies: some sources note n...

Umbraco 安全漏洞

Umbraco is an open source Content Management System CMS written in C by the Danish company Umbraco. A security vulnerability exists in Umbraco CMS version 7.12.4, which originates from a vulnerability that allows an authenticated administrator to execute remote code via msxsl:script in...

CVE-2021-33224

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file...

CVE-2021-33224

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file...

Unrestricted file upload

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file...

Umbraco Forms 代码问题漏洞

Umbraco Forms is a form builder. A security vulnerability exists in Umbraco Forms version v.8.7.0 that originates from a vulnerability that allows an unauthenticated attacker to execute arbitrary code via a crafted web.config and asp file...

CVE-2021-33224

The CVE-2021-33224 entry concerns Umbraco Forms v8.7.0, which is affected by a file upload vulnerability that allows unauthenticated attackers to execute arbitrary code via a crafted web.config and ASP file. The root cause is a flaw in handling file uploads in Umbraco Forms, enabling remote code ...

CVE-2021-33224

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file...

CVE-2021-33224

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file...

PT-2023-12200 · Umbraco · Umbraco Forms

Name of the Vulnerable Software and Affected Versions: Umbraco Forms version 8.7.0 Description: The issue allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file. This is a result of a file upload vulnerability. Recommendations: For Umbraco Forms version...

GHSA-95QR-67RX-9PGH Umbraco CMS vulnerable to stored XSS

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...