kentico kentico vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv2

An issue exists in Kentico 12.0.x prior to 12.0.15, 11.0.x prior to 11.0.48, 10.0.x prior to 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and p...

Kentico Kentico

6.4

CVSSv2

Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs_media.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library ...

Kentico Kentico

4.3

CVSSv2

Cross Site Scripting (XSS) vulnerability in Kentico prior to 12.0.75.

Kentico Kentico

3.5

CVSSv2

Kentico prior to 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS.

Kentico Kentico

NA

In Kentico prior to 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler.

Kentico Kentico

4

CVSSv2

Kentico CMS prior to 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights (default is Administrator) to export the user options of any user, even ones with higher privileges (like Global Administrators) than the current ...

Kentico Kentico

6.5

CVSSv2

Kentico 10 prior to 10.0.50 and 11 prior to 11.0.3 has SQL injection in the administration interface.

Kentico Kentico Cms

3.5

CVSSv2

Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote malicious users to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages -> Edit...

Kentico Kentico Cms

4

CVSSv2

Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time

Kentico Kentico 10.0.42

3.5

CVSSv2

Kentico 10 prior to 10.0.50 and 11 prior to 11.0.3 has XSS in which a crafted URL results in improper construction of a system page.

Kentico Kentico Cms

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook