Browse CVEs

MEDIUM 5.4 CVE-2022-0832EPSS 67% Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. Pimcore 10.3.3+ Fix from $1,6002022-03-04 MEDIUM 6.5 CVE-2022-0665 Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2. Pimcore 10.3.2+ Fix from $1,6002022-02-22 MEDIUM 6.4 CVE-2022-0565 Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1. Pimcore 10.3.1+ Fix from $1,6002022-02-14 MEDIUM 5.4 CVE-2022-0510 Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1. Pimcore after 10.3.0 Fix from $1,6002022-02-08 MEDIUM 5.4 CVE-2022-0509 Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1. Pimcore 10.3.1+ Fix from $1,6002022-02-08 MEDIUM 5.4 CVE-2022-0348 Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2. Pimcore 10.2+ Fix from $1,6002022-01-27 MEDIUM 5.4 CVE-2022-0251 Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10. Pimcore 10.2.0+ Fix from $1,6002022-01-26 MEDIUM 5.4 CVE-2022-0285 Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9. Pimcore 10.2.9+ Fix from $1,6002022-01-20 HIGH 7.8 CVE-2022-0263 Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7. Pimcore 10.2.7+ Fix from $1,9502022-01-18 MEDIUM 6.1 CVE-2022-0262 Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7. Pimcore 10.2.7+ Fix from $1,6002022-01-18 MEDIUM 5.4 CVE-2022-0260 Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7. Pimcore 10.2.7+ Fix from $1,6002022-01-18 HIGH 8.8 CVE-2022-0258 pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command Pimcore 10.2.8+ Fix from $1,9502022-01-17 MEDIUM 5.4 CVE-2022-0256 pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Pimcore 10.2.8+ Fix from $1,6002022-01-17 MEDIUM 5.4 CVE-2022-0257 pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Pimcore 10.2.8+ Fix from $1,6002022-01-17 CRITICAL 9.0 CVE-2021-4139 pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Pimcore 10.2.7+ Fix from $2,3002021-12-21 MEDIUM 6.1 CVE-2021-4084 pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Pimcore 10.2.6+ Fix from $1,6002021-12-10 MEDIUM 6.1 CVE-2021-4081 pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Pimcore 10.2.6+ Fix from $1,6002021-12-10 MEDIUM 5.3 CVE-2021-39189 Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot pa… Pimcore 10.1.3+ Fix from $1,6002021-09-15 MEDIUM 5.4 CVE-2021-39170 Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of cust… Pimcore 10.1.2+ Fix from $1,6002021-09-01 MEDIUM 5.4 CVE-2021-39166 Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the… Pimcore 10.1.2+ Fix from $1,6002021-09-01 HIGH 8.8 CVE-2021-37702 Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The probl… Pimcore 10.1.1+ Fix from $1,9502021-08-18 HIGH 7.5 CVE-2021-31867 Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentA… Customer Management Framework 3.0.2+ Fix from $1,9502021-08-04 HIGH 7.5 CVE-2021-31869 Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application. This issue was f… Pimcore 6.9.4+ Fix from $1,9502021-08-04 HIGH 8.8 CVE-2021-23405 This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collecti… Pimcore 10.0.7+ Fix from $1,9502021-07-09 HIGH 7.1 CVE-2021-23340 This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomRep… Pimcore 6.8.8+ Fix from $1,9502021-02-18 MEDIUM 6.5 CVE-2020-26246 Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without hav… Pimcore 6.8.5+ Fix from $1,6002020-12-03 HIGH 7.2 CVE-2020-7759 The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreCo… Pimcore 6.8.3+ Fix from $1,9502020-10-30 MEDIUM 6.5 CVE-2019-10763 pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection tha… Pimcore 6.3.0+ Fix from $1,6002019-11-18 HIGH 7.5 CVE-2019-18986 Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messa… Pimcore 6.2.2+ Fix from $1,9502019-11-15 CRITICAL 9.8 CVE-2019-18981 Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification. Pimcore 6.2.2+ Fix from $2,3002019-11-15