CVE-2017-15279

Umbraco CMS prior to 7.7.3 contains an XSS vulnerability exploitable via the PageName/nodename parameter during new page creation. The issue arises from improper input sanitization, allowing an attacker’s script/HTML to be stored and subsequently served to users. Reported across multiple sources ...

CVE-2017-15280

XML external entity XXE vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts aka SSRF, related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs...

CVE-2017-15280

The CVE-2017-15280 entry applies to Umbraco CMS and describes an XML External Entity (XXE) vulnerability affecting earlier Umbraco versions (notably before 7.7.3). The underlying issue is XXE in the XML parsing path related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.as...

CVE-2017-15279

Cross-site scripting XSS vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" aka nodename parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and...

Umbraco CMS Cross-Site Scripting Vulnerability (CNVD-2017-30256)

Umbraco is the leading open source Microsoft ASP.NET CMS. A cross-site scripting vulnerability exists in Umbraco CMS, which allows remote attackers to inject arbitrary web script or HTML via the "page name" parameter during the creation of a new page...

Umbraco CMS XML External Entity Vulnerability

Umbraco is the leading open source Microsoft ASP.NET CMS. An XML external entity vulnerability exists in Umbraco CMS, which could allow an attacker to obtain sensitive information by reading files on the server or sending TCP requests to an intranet host...

CVE-2012-1301

The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter...

Design/Logic Flaw

The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter...

CVE-2012-1301

The CVE-2012-1301 vulnerability affects Umbraco 4.7.0 where the FeedProxy.aspx script can be abused to proxy arbitrary requests via the url parameter, enabling an open-proxy condition. The root cause is improper handling of the url parameter in FeedProxy.aspx, allowing unauthenticated remote use ...

CVE-2012-1301

The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter...

Cross site request forgery (csrf)

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery CSRF attacks as demonstrated by editing user account information in the templates.asmx.cs file...

Server side request forgery (ssrf)

The PageLoad function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery SSRF attacks via the url parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML via the name parameter to 1 the media page, 2 the developer data edit page, or 3 the form page...

CVE-2015-8814

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery CSRF attacks as demonstrated by editing user account information in the templates.asmx.cs file...

CVE-2015-8815

Multiple cross-site scripting XSS vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML via the name parameter to 1 the media page, 2 the developer data edit page, or 3 the form page...

CVE-2015-8813

The PageLoad function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery SSRF attacks via the url parameter...

CVE-2015-8814

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery CSRF attacks as demonstrated by editing user account information in the templates.asmx.cs file...

CVE-2015-8815

The CVE-2015-8815 entry concerns Umbraco CMS prior to version 7.4.0, where multiple XSS vulnerabilities exist. The issue allows remote attackers to inject arbitrary web script or HTML via the name parameter on the media page, the developer data edit page, or the form page. Connected records corro...

CVE-2015-8813

The PageLoad function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery SSRF attacks via the url parameter...

CVE-2015-8815

Multiple cross-site scripting XSS vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML via the name parameter to 1 the media page, 2 the developer data edit page, or 3 the form page...