Vulnerabilities > Silverstripe
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-01-23 | CVE-2017-18049 | Injection vulnerability in Silverstripe In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, which may be executed if imported without sanitization into common software (including Microsoft Excel). | 4.3 |
| 2017-10-12 | CVE-2017-12849 | Information Exposure vulnerability in Silverstripe Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks. | 5.0 |
| 2017-09-15 | CVE-2017-14498 | Cross-site Scripting vulnerability in Silverstripe SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017. | 4.3 |
| 2017-03-06 | CVE-2017-5197 | Cross-site Scripting vulnerability in Silverstripe There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. | 4.3 |
| 2016-04-13 | CVE-2015-8606 | Cross-site Scripting vulnerability in Silverstripe Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm. | 4.3 |
| 2015-06-24 | CVE-2015-5063 | Cross-site Scripting vulnerability in Silverstripe 3.1.13 Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework 3.1.13 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter to install.php. | 4.3 |
| 2015-06-24 | CVE-2015-5062 | Open Redirection and Cross Site Scripting vulnerability in Silverstripe 3.1.13 Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter to dev/build. network silverstripe | 5.8 |
| 2014-04-08 | CVE-2011-4958 | Cross-Site Scripting vulnerability in Silverstripe Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as demonstrated by a request to (1) admin/reports/, (2) admin/comments/, (3) admin/, (4) admin/show/, (5) admin/assets/, and (6) admin/security/. | 4.3 |
| 2013-11-13 | CVE-2013-6789 | Information Exposure vulnerability in Silverstripe 3.0.3 security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history, a similar vulnerability to CVE-2013-2653. | 5.0 |
| 2013-11-13 | CVE-2013-2653 | Improper Input Validation vulnerability in Silverstripe 3.0.3 security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote attackers to conduct phishing attacks without detection by the victim. | 5.8 |