Filtered by vendor Pimcore
Subscribe
Total
137 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-4145 | 1 Pimcore | 1 Customer Data Framework | 2023-12-10 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2. | |||||
| CVE-2023-5192 | 1 Pimcore | 1 Core | 2023-12-10 | N/A | 6.5 MEDIUM |
| Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0. | |||||
| CVE-2023-4453 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8. | |||||
| CVE-2023-3820 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 7.2 HIGH |
| SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4. | |||||
| CVE-2023-1703 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20. | |||||
| CVE-2023-2336 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 6.5 MEDIUM |
| Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21. | |||||
| CVE-2023-30855 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 7.5 HIGH |
| Pimcore is an open source data and experience management platform. Versions of Pimcore prior to 10.5.18 are vulnerable to path traversal. The impact of this path traversal and arbitrary extension is limited to creation of arbitrary files and appending data to existing files. When combined with the SQL Injection, the exported data `RESTRICTED DIFFUSION 9 / 9` can be controlled and a webshell can be uploaded. Attackers can use that to execute arbitrary PHP code on the server with the permissions of the webserver. Users may upgrade to version 10.5.18 to receive a patch or, as a workaround, apply the patch manually. | |||||
| CVE-2023-2615 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. | |||||
| CVE-2023-2614 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21. | |||||
| CVE-2023-2881 | 1 Pimcore | 1 Customer-data-framework | 2023-12-10 | N/A | 4.9 MEDIUM |
| Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10. | |||||
| CVE-2023-28438 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 8.0 HIGH |
| Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually. | |||||
| CVE-2023-1704 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20. | |||||
| CVE-2023-2327 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. | |||||
| CVE-2023-32075 | 1 Pimcore | 1 Customer Management Framework | 2023-12-10 | N/A | 4.3 MEDIUM |
| The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually. | |||||
| CVE-2023-2730 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. | |||||
| CVE-2023-2983 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 8.8 HIGH |
| Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23. | |||||
| CVE-2023-30848 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 8.8 HIGH |
| Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually. | |||||
| CVE-2023-2756 | 1 Pimcore | 1 Customer Management Framework | 2023-12-10 | N/A | 7.2 HIGH |
| SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10. | |||||
| CVE-2023-2984 | 2 Microsoft, Pimcore | 2 Windows, Pimcore | 2023-12-10 | N/A | 8.8 HIGH |
| Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22. | |||||
| CVE-2023-1515 | 1 Pimcore | 1 Pimcore | 2023-12-10 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. | |||||