Total
72 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-4146 | 1 Pimcore | 1 Pimcore | 2022-01-24 | 4.0 MEDIUM | 4.3 MEDIUM |
| Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6. | |||||
| CVE-2022-0263 | 1 Pimcore | 1 Pimcore | 2022-01-24 | 4.6 MEDIUM | 7.8 HIGH |
| Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7. | |||||
| CVE-2022-0260 | 1 Pimcore | 1 Pimcore | 2022-01-24 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7. | |||||
| CVE-2022-0262 | 1 Pimcore | 1 Pimcore | 2022-01-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7. | |||||
| CVE-2021-4139 | 1 Pimcore | 1 Pimcore | 2022-01-07 | 6.0 MEDIUM | 9.0 CRITICAL |
| pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2021-4082 | 1 Pimcore | 1 Pimcore | 2021-12-13 | 4.3 MEDIUM | 4.3 MEDIUM |
| pimcore is vulnerable to Cross-Site Request Forgery (CSRF) | |||||
| CVE-2021-4084 | 1 Pimcore | 1 Pimcore | 2021-12-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2021-4081 | 1 Pimcore | 1 Pimcore | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2021-39189 | 1 Pimcore | 1 Pimcore | 2021-09-27 | 5.0 MEDIUM | 5.3 MEDIUM |
| Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually. | |||||
| CVE-2021-39170 | 1 Pimcore | 1 Pimcore | 2021-09-09 | 3.5 LOW | 5.4 MEDIUM |
| Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually. | |||||
| CVE-2021-39166 | 1 Pimcore | 1 Pimcore | 2021-09-09 | 3.5 LOW | 5.4 MEDIUM |
| Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2. | |||||
| CVE-2021-37702 | 1 Pimcore | 1 Pimcore | 2021-08-25 | 6.5 MEDIUM | 8.8 HIGH |
| Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround. | |||||
| CVE-2021-23405 | 1 Pimcore | 1 Pimcore | 2021-07-21 | 6.5 MEDIUM | 8.8 HIGH |
| This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class. | |||||
| CVE-2021-23340 | 1 Pimcore | 1 Pimcore | 2021-02-25 | 5.5 MEDIUM | 7.1 HIGH |
| This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability. | |||||
| CVE-2020-26246 | 1 Pimcore | 1 Pimcore | 2020-12-03 | 4.0 MEDIUM | 6.5 MEDIUM |
| Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions. | |||||
| CVE-2020-7759 | 1 Pimcore | 1 Pimcore | 2020-11-03 | 6.5 MEDIUM | 7.2 HIGH |
| The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{"keyId"%3a"''","groupId"%3a"'asd'))+or+1%3d1+union+(select+1,2,3,4,5,6,name,8,password,'',11,12,'',14+from+users)+--+"}] | |||||
| CVE-2019-10867 | 1 Pimcore | 1 Pimcore | 2020-03-18 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php. | |||||
| CVE-2019-10763 | 1 Pimcore | 1 Pimcore | 2020-03-18 | 4.0 MEDIUM | 6.5 MEDIUM |
| pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection. | |||||
| CVE-2019-18981 | 1 Pimcore | 1 Pimcore | 2019-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification. | |||||
| CVE-2019-18986 | 1 Pimcore | 1 Pimcore | 2019-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users. | |||||