Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.
- Update to 10.2.10
Published Updated
PatchFirst · Latest vulnerabilities
pimcore/pimcore vulnerabilities · Page 6
Vulnerabilities published for pimcore/pimcore in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 135
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10.
- Update to 10.2.10
Published UpdatedCross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
- Update to 10.2.9
Published UpdatedUnrestricted Upload of File with Dangerous Type in pimcore/pimcore
Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.
- Update to 10.2.7
Published UpdatedCross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.
- Update to 10.2.7
Published UpdatedBusiness Logic Errors in pimcore/pimcore
Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.
- Update to 10.2.9
Published UpdatedCross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7.
- Update to 10.2.9
Published UpdatedCross-site Scripting (XSS) - Stored in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Update to 10.2.9
Published UpdatedSQL Injection in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
- Update to 10.2.9
Published UpdatedCross-site Scripting (XSS) - Stored in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Update to 10.2.9
Published UpdatedCross-site Scripting (XSS) - Stored in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Update to 10.2.7
Published UpdatedCross-site Scripting (XSS) - Stored in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Update to 10.2.6
Published UpdatedCross-site Scripting (XSS) - Reflected in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Update to 10.2.6
Published UpdatedCross-Site Request Forgery (CSRF) in pimcore/pimcore
pimcore is vulnerable to Cross-Site Request Forgery (CSRF)
- Update to 10.2.6
Published UpdatedObservable Response Discrepancy in Lost Password Service
Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.
- Update to 10.1.3
Published UpdatedImproper Encoding or Escaping of Output in Asset Metadata Component
Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually.
- Update to 10.1.2
Published UpdatedImproper Neutralization of Text-Values in Object Version Preview
Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2.
- Update to 10.1.2
Published UpdatedCKEditor 4 vulnerabilities in versions <4.16.1
Details see: https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 ) https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 ) https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg ( CVE-2021-32809 ) Patch: https://github.com/pimcore/pimcore/pull/10032
- Update to 10.1.1
Published UpdatedImproper Neutralization of Formula Elements in a CSV File in pimcore/pimcore
Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround.
- Update to 10.1.1
Published UpdatedSQL Injection
This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.
- Update to 10.0.7
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.