Vulnerabilidades de craftcms/cms · Página 7

CVE-2018-20418

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.

CVE-2018-3814

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.

CVE-2017-9516

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

• Actualiza a 2.6.2982

CVE-2017-8385

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.

• Actualiza a 2.6.2976

CVE-2017-8384

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.

• Actualiza a 2.6.2976

CVE-2017-8383

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.

• Actualiza a 2.6.2976

CVE-2017-8052

Craft CMS before 2.6.2974 allows XSS attacks.

• Actualiza a 2.6.2974