Pimcore
by Pimcore
Source repositories
CVEs (122)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-28438 | 0.00 | — | 0.01 | Mar 22, 2023 | Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject… | |||
| CVE-2023-1578 | 0.00 | — | 0.65 | Mar 22, 2023 | SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19. | |||
| CVE-2023-28429 | 0.00 | — | 0.01 | Mar 20, 2023 | Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through… | |||
| CVE-2023-1515 | 0.00 | — | 0.00 | Mar 20, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. | |||
| CVE-2023-1517 | 0.00 | — | 0.00 | Mar 20, 2023 | Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19. | |||
| CVE-2023-28108 | 0.00 | — | 0.01 | Mar 16, 2023 | Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper… | |||
| CVE-2023-28106 | 0.00 | — | 0.01 | Mar 16, 2023 | Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch… | |||
| CVE-2023-1429 | 0.00 | — | 0.00 | Mar 16, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. | |||
| CVE-2023-1312 | 0.00 | — | 0.00 | Mar 10, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. | |||
| CVE-2023-1286 | 0.00 | — | 0.00 | Mar 9, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. | |||
| CVE-2023-1115 | 0.00 | — | 0.01 | Mar 1, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. | |||
| CVE-2023-1116 | 0.00 | — | 0.01 | Mar 1, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. | |||
| CVE-2023-1117 | 0.00 | — | 0.00 | Mar 1, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. | |||
| CVE-2023-1067 | 0.00 | — | 0.00 | Feb 27, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. | |||
| CVE-2023-0827 | 0.00 | — | 0.03 | Feb 14, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17. | |||
| CVE-2023-25240 | 0.00 | — | 0.01 | Feb 13, 2023 | An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. | |||
| CVE-2023-23937 | 0.00 | — | 0.00 | Feb 3, 2023 | Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by… | |||
| CVE-2023-0323 | 0.00 | — | 0.00 | Jan 16, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14. | |||
| CVE-2022-39365 | 0.00 | — | 0.02 | Oct 27, 2022 | Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in `Pimcore/Mail` & `ClassDefinition\Layout\Text` is vulnerable to server-side template injection, which could lead to remote code execution.… | |||
| CVE-2022-3255 | 0.00 | — | 0.01 | Sep 21, 2022 | If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is… |
- CVE-2023-28438Mar 22, 2023risk 0.00cvss —epss 0.01
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject…
- CVE-2023-1578Mar 22, 2023risk 0.00cvss —epss 0.65
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.
- CVE-2023-28429Mar 20, 2023risk 0.00cvss —epss 0.01
Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through…
- CVE-2023-1515Mar 20, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
- CVE-2023-1517Mar 20, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
- CVE-2023-28108Mar 16, 2023risk 0.00cvss —epss 0.01
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper…
- CVE-2023-28106Mar 16, 2023risk 0.00cvss —epss 0.01
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch…
- CVE-2023-1429Mar 16, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
- CVE-2023-1312Mar 10, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
- CVE-2023-1286Mar 9, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
- CVE-2023-1115Mar 1, 2023risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
- CVE-2023-1116Mar 1, 2023risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
- CVE-2023-1117Mar 1, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
- CVE-2023-1067Feb 27, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
- CVE-2023-0827Feb 14, 2023risk 0.00cvss —epss 0.03
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.
- CVE-2023-25240Feb 13, 2023risk 0.00cvss —epss 0.01
An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.
- CVE-2023-23937Feb 3, 2023risk 0.00cvss —epss 0.00
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by…
- CVE-2023-0323Jan 16, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.
- CVE-2022-39365Oct 27, 2022risk 0.00cvss —epss 0.02
Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in `Pimcore/Mail` & `ClassDefinition\Layout\Text` is vulnerable to server-side template injection, which could lead to remote code execution.…
- CVE-2022-3255Sep 21, 2022risk 0.00cvss —epss 0.01
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is…
Page 4 of 7