Latest umbraco umbraco cms Vulnerabilities

● CVE-2023-49279

Umbraco CMS vulnerable to stored XSS via SVG File Upload

nuget/Umbraco.CMS>=12.0.0<12.2.0

nuget/Umbraco.CMS>=11.0.0<11.5.0

nuget/Umbraco.CMS>=9.0.0<10.7.0

nuget/Umbraco.CMS>=8.0.0<8.18.9

nuget/Umbraco.CMS>=7.0.0<7.15.11

Umbraco Umbraco Cms>=7.0.0<7.15.11

and 4 more

● CVE-2023-49278

Umbraco CMS brute force exploit can be used to collect valid usernames

nuget/Umbraco.CMS>=11.0.0<12.3.4

nuget/Umbraco.CMS>=9.0.0<10.8.1

nuget/Umbraco.CMS>=8.0.0<8.18.10

Umbraco Umbraco Cms>=8.0.0<8.18.10

Umbraco Umbraco Cms>=10.0.0<10.8.1

Umbraco Umbraco Cms>=12.0.0<12.3.4

● CVE-2023-49274

Umbraco CMS SMTP misconfiguration exposes potential registered user email

nuget/Umbraco.CMS>=11.0.0<12.3.4

nuget/Umbraco.CMS>=9.0.0<10.8.1

nuget/Umbraco.CMS>=8.0.0<8.18.10

Umbraco Umbraco Cms>=8.0.0<8.18.10

Umbraco Umbraco Cms>=10.0.0<10.8.1

Umbraco Umbraco Cms>=12.0.0<12.3.4

● CVE-2023-49273

Umbraco CMS vulnerable to Privilege Escalation using Spoofing

nuget/Umbraco.CMS>=11.0.0<12.3.4

nuget/Umbraco.CMS>=9.0.0<10.8.1

nuget/Umbraco.CMS>=8.0.0<8.18.10

Umbraco Umbraco Cms>=8.0.0<8.18.10

Umbraco Umbraco Cms>=10.0.0<10.8.1

Umbraco Umbraco Cms>=12.0.0<12.3.4

and 3 more

● CVE-2023-49089

Umbraco CMS possible path traversal when creating packages from backoffice

nuget/Umbraco.CMS>=11.0.0<12.3.4

nuget/Umbraco.CMS>=9.0.0<10.8.1

nuget/Umbraco.CMS>=8.0.0<8.18.10

Umbraco Umbraco Cms>=8.0.0<8.18.10

Umbraco Umbraco Cms>=10.0.0<10.8.1

Umbraco Umbraco Cms>=12.0.0<12.3.0

● CVE-2023-48313

Umbraco contains a DOM-XSS

nuget/Umbraco.CMS>=11.0.0<12.3.4

nuget/Umbraco.CMS>=10.0.0<10.8.1

Umbraco Umbraco Cms>=10.0.0<10.8.1

Umbraco Umbraco Cms>=12.0.0<12.3.4

● CVE-2023-48227

Umbraco CMS Backoffice User can bypass "Publish" restriction

nuget/Umbraco.CMS>=11.0.0<12.3.0

nuget/Umbraco.CMS>=9.0.0<10.8.0

nuget/Umbraco.CMS>=8.0.0<8.18.10

Umbraco Umbraco Cms>=8.0.0<8.18.10

Umbraco Umbraco Cms>=9.0.0<10.7.0

Umbraco Umbraco Cms>=11.0.0<12.3.0

and 3 more

● CVE-2023-38694

Umbraco CMS vulnerable to possible injection of HTML in an unintended form

nuget/Umbraco.CMS>=11.0.0<12.1.0

nuget/Umbraco.CMS>=9.0.0<10.7.0

nuget/Umbraco.CMS>=8.0.0<8.18.10

Umbraco Umbraco Cms>=8.0.0<8.18.10

Umbraco Umbraco Cms>=9.0.0<10.7.0

Umbraco Umbraco Cms>=11.0.0<12.1.0

● CVE-2023-37267

Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0....

Umbraco Umbraco Cms>=10.0.0<10.6.1

Umbraco Umbraco Cms>=11.0.0<11.4.2

Umbraco Umbraco Cms>=12.0.0<12.0.1

● CVE-2019-25137

Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx.

Umbraco Umbraco Cms>=4.11.8<=7.15.10

● CVE-2022-22690

Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site. For example, ...

Umbraco Umbraco Cms<9.2.0

● CVE-2022-22691

The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbr...

Umbraco Umbraco Cms<9.2.0

● CVE-2021-34254

Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx.

Umbraco Umbraco Cms<7.15.7

● CVE-2020-5810

A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which act as a stored XSS payload.

Umbraco Umbraco Cms<=8.9.1

● CVE-2020-5811

An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and ex...

Umbraco Umbraco Cms<=8.9.1

● CVE-2020-5809

A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, a...

nuget/UmbracoCms.Core<=8.9.1

Umbraco Umbraco Cms<=8.9.1

● CVE-2020-29454

Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.

Umbraco Umbraco Cms>=8.0.0<=8.9.1

● CVE-2020-9472

Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.

Umbraco Umbraco Cms=8.5.3

● CVE-2020-9471

Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.

Umbraco Umbraco Cms=8.5.3

● CVE-2018-17256

Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vul...

nuget/umbraco<=7.12.3

Umbraco Umbraco Cms=7.12.3

● CVE-2014-10074

Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files.

Umbraco Umbraco Cms<7.2.0

Latest umbraco umbraco cms Vulnerabilities

Company

Resources

Contact