oroinc records

13 published records for vendor oroinc.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 92.3%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

13 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2022-41951No exploit	OroPlatform vulnerable to path traversal during temporary file manipulationsoroinc · oroplatform · CWE-22 Pre-auth Path traversal	Critical9.8	—	0.9%	Nov 27, 2023
35Monitor	CVE-2021-43852No exploit	JavaScript Prototype Pollution in oro/platformoroinc · oroplatform · CWE-74 Pre-auth Prototype pollution	High8.8	—	1.1%	Jan 4, 2022
24Monitor	CVE-2024-50677Proof of concept	A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted poroinc · oroplatform · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.5%	Dec 6, 2024
23Monitor	CVE-2023-32065No exploit	OroCommerce get-totals-for-checkout API endpoint returns unwanted dataoroinc · orocommerce · CWE-284 Pre-auth Broken access control (IDOR)	Medium5.8	—	0.4%	Nov 28, 2023
21Monitor	CVE-2022-31037No exploit	OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing pageoroinc · orocommerce · CWE-79 XSS	Medium5.4	—	0.5%	Oct 18, 2022
21Monitor	CVE-2021-39198No exploit	The disqualify lead action may be executed without CSRF token checkoroinc · client relationship management · CWE-352 Pre-auth CSRF	Medium5.4	—	0.3%	Nov 19, 2021
20Monitor	CVE-2023-32063No exploit	OroCRMCallBundle has incorrect call view page visibilityoroinc · client relationship management · CWE-284 Broken access control (IDOR)	Medium5.0	—	0.5%	Nov 28, 2023
19Monitor	CVE-2021-41236No exploit	XSS vulnerability in oro/platformoroinc · oroplatform · CWE-79 XSS	Medium4.8	—	0.6%	Jan 4, 2022
19Monitor	CVE-2022-35950No exploit	OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line itemoroinc · orocommerce · CWE-79 XSS	Medium4.8	—	0.4%	Oct 9, 2023
17Monitor	CVE-2023-32062No exploit	OroCalendarBundle has incorrect system calendar events visibilityoroinc · oroplatform · CWE-284 Broken access control (IDOR)	Medium4.3	—	0.5%	Nov 27, 2023
17Monitor	CVE-2023-32064No exploit	OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibilityoroinc · orocommerce · CWE-284 Broken access control (IDOR)	Medium4.3	—	0.4%	Nov 28, 2023
17Monitor	CVE-2023-45824No exploit	OroPlatform's pinned entity creation form shows pages of other usersoroinc · oroplatform · CWE-200 Info leak	Medium4.3	—	0.4%	Mar 25, 2024
17Monitor	CVE-2023-48296No exploit	OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same IDoroinc · oroplatform · CWE-200 Info leak	Medium4.3	—	0.4%	Mar 25, 2024

CVE-2022-41951
39Monitor
OroPlatform vulnerable to path traversal during temporary file manipulations
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Path traversal
oroinc · oroplatformNov 27, 2023
CVE-2021-43852
35Monitor
JavaScript Prototype Pollution in oro/platform
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
- Prototype pollution
oroinc · oroplatformJan 4, 2022
CVE-2024-50677
24Monitor
A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted p
MediumCVSS 6.1Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
oroinc · oroplatformDec 6, 2024
CVE-2023-32065
23Monitor
OroCommerce get-totals-for-checkout API endpoint returns unwanted data
MediumCVSS 5.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oroinc · orocommerceNov 28, 2023
CVE-2022-31037
21Monitor
OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page
MediumCVSS 5.4No exploitEPSS 0%
- XSS
oroinc · orocommerceOct 18, 2022
CVE-2021-39198
21Monitor
The disqualify lead action may be executed without CSRF token check
MediumCVSS 5.4No exploitEPSS 0%
- Pre-auth
- CSRF
oroinc · client relationship managementNov 19, 2021
CVE-2023-32063
20Monitor
OroCRMCallBundle has incorrect call view page visibility
MediumCVSS 5.0No exploitEPSS 0%
- Broken access control (IDOR)
oroinc · client relationship managementNov 28, 2023
CVE-2021-41236
19Monitor
XSS vulnerability in oro/platform
MediumCVSS 4.8No exploitEPSS 0%
- XSS
oroinc · oroplatformJan 4, 2022
CVE-2022-35950
19Monitor
OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item
MediumCVSS 4.8No exploitEPSS 0%
- XSS
oroinc · orocommerceOct 9, 2023
CVE-2023-32062
17Monitor
OroCalendarBundle has incorrect system calendar events visibility
MediumCVSS 4.3No exploitEPSS 0%
- Broken access control (IDOR)
oroinc · oroplatformNov 27, 2023
CVE-2023-32064
17Monitor
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
MediumCVSS 4.3No exploitEPSS 0%
- Broken access control (IDOR)
oroinc · orocommerceNov 28, 2023
CVE-2023-45824
17Monitor
OroPlatform's pinned entity creation form shows pages of other users
MediumCVSS 4.3No exploitEPSS 0%
- Info leak
oroinc · oroplatformMar 25, 2024
CVE-2023-48296
17Monitor
OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID
MediumCVSS 4.3No exploitEPSS 0%
- Info leak
oroinc · oroplatformMar 25, 2024