Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
175 results · page 4 of 4
Sep 1, 2021Pimcore is an open source data & experience management platform.CVE-2021-39170 · Other software · pimcore · reported by GitHubHigh 8
Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021Pimcore is an open source data & experience management platform.CVE-2021-39166 · Other software · pimcore · reported by GitHubHigh 8
Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2021Pimcore is an open source data & experience management platform.CVE-2021-37702 · Other software · pimcore · reported by GitHubHigh 8
Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2021Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application.CVE-2021-31869 · Other software · Pimcore · reported by cve@rapid7.comMedium 6.5
Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application. This issue was fixed in version 6.9.4 of the product.
- Product
- Pimcore AdminBundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2021Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAssignmentCoCVE-2021-31867 · Other software · Pimcore · reported by cve@rapid7.comMedium 6.5
Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAssignmentController.php component of the application. This issue was fixed in version 3.0.2 of the product.
- Product
- Pimcore Customer Data Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2021This affects the package pimcore/pimcore before 10.0.7.CVE-2021-23405 · Other software · Pimcore · reported by report@snyk.ioHigh 8.3
This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2021This affects the package pimcore/pimcore before 6.8.8.CVE-2021-23340 · Other software · Pimcore · reported by report@snyk.ioHigh 7.1
This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2020Pimcore is an open source digital experience platform.CVE-2020-26246 · Other software · pimcore · reported by GitHubHigh 7.7
Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2020The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController.CVE-2020-7759 · Other software · Pimcore · reported by report@snyk.ioMedium 6.5
The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{"keyId"%3a"''","groupId"%3a"'asd'))+or+1%3d1+union+(select+1,2,3,4,5,6,name,8,password,'',11,12,'',14+from+users)+--+"}]
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2019pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection.CVE-2019-10763 · Other software · Pimcore · reported by report@snyk.ioMedium 6.5
pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.certimetergroup.comsnyk.io
Nov 15, 2019Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invCVE-2019-18986 · Other software · Pimcore · reported by MITREHigh 7.5
Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2019Pimcore before 6.2.2 lacks brute force protection for the 2FA token.CVE-2019-18985 · Other software · Pimcore · reported by MITRECritical 9.8
Pimcore before 6.2.2 lacks brute force protection for the 2FA token.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2019bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of CVE-2019-18982 · Other software · Pimcore · reported by MITREMedium 6.1
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2019Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.CVE-2019-18981 · Other software · Pimcore · reported by MITRECritical 9.8
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2019Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elementsCVE-2019-18656 · Other software · Pimcore · reported by MITREMedium 6.1
Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2019In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failureCVE-2019-16318 · Other software · Pimcore · reported by MITREHigh 8.8
In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2019In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploaCVE-2019-16317 · Other software · Pimcore · reported by MITREHigh 8.8
In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2019An issue was discovered in Pimcore before 5.7.1.CVE-2019-10867 · Other software · Pimcore · reported by MITREHigh 8.8
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comrapid7.com
Aug 24, 2018Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, PrCVE-2018-14059 · Other software · Pimcore · reported by MITREMedium 5.4
Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 17, 2018Pimcore before 5.3.0 allows SQL Injection via the REST web service API.CVE-2018-14058 · Other software · Pimcore · reported by MITREMedium 6.5
Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 17, 2018Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRFCVE-2018-14057 · Other software · Pimcore · reported by MITREHigh 8.8
Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the "Settings > Users / Roles" function.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 18, 2015SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-CVE-2015-4426 · Other software · Pimcore · reported by MITREHigh 7.5
SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Aug 18, 2015Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary fiCVE-2015-4425 · Other software · Pimcore · reported by MITREMedium 4.9
Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Apr 21, 2014The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtainedCVE-2014-2922 · Other software · Pimcore · reported by MITREMedium 6.4
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.compimcore.org
Apr 21, 2014The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtainedCVE-2014-2921 · Other software · Pimcore · reported by MITREHigh 7.5
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.compimcore.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.