pimcore kayıtları

pimcore üreticisine ait 155 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren: 0 · %0
Silahlaştırılmış: 2 · %1,3
Pre-auth RCE: 6
Düzeltme kaydı olan: %95,5
Yayından KEV’e ortanca: KEV’e giren kayıt yok

Yıllara göre kayıt

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

Saldırı profili

Tüm kayıtlar

155 kayıt

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
56Planlayın	CVE-2019-10867Silahlaştırılmış	An issue was discovered in Pimcore before 5.7.1.pimcore · pimcore · CWE-502 Deserializasyon	Yüksek8,8	—	%68,9	4 Nis 2019
54Planlayın	CVE-2023-1578İstismar yok	SQL Injection in pimcore/pimcorepimcore · pimcore · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%62,8	22 Mar 2023
49Planlayın	CVE-2022-1429İstismar yok	SQL injection in GridHelperService.php in pimcore/pimcorepimcore · pimcore · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek7,5	—	%63,9	22 Nis 2022
41Planlayın	CVE-2022-0832İstismar yok	Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore · pimcore · CWE-79 XSS	Orta5,4	—	%66,6	4 Mar 2022
40Planlayın	CVE-2022-39365İstismar yok	RCE vulnerability in Pimcore/Mail & Dynamic Text Layoutpimcore · pimcore · CWE-94 pre-auth RCE SSTI	Kritik9,8	—	%1,8	27 Eki 2022
39İzleyin	CVE-2019-18985İstismar yok	Pimcore before 6.2.2 lacks brute force protection for the 2FA token.pimcore · pimcore · CWE-307 Kimlik doğrulamasız	Kritik9,8	—	%1,4	15 Kas 2019
39İzleyin	CVE-2019-18981İstismar yok	Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.pimcore · pimcore · CWE-838 Kimlik doğrulamasız	Kritik9,8	—	%1,4	15 Kas 2019
37İzleyin	CVE-2024-25625İstismar yok	Pimcore Host Header Injection in user invitation linkpimcore · admin classic bundle · CWE-74 Kimlik doğrulamasız	Kritik9,3	—	%0,7	19 Şub 2024
36İzleyin	CVE-2018-14057Kavram kanıtı	Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-pimcore · pimcore · CWE-352 Kimlik doğrulamasız CSRF	Yüksek8,8	—	%3,3	17 Ağu 2018
36İzleyin	CVE-2021-23405İstismar yok	This affects the package pimcore/pimcore before 10.0.7.pimcore · pimcore · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%1,7	9 Tem 2021
36İzleyin	CVE-2019-16317İstismar yok	In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameterpimcore · pimcore · CWE-502 Deserializasyon	Yüksek8,8	—	%1,7	14 Eyl 2019
36İzleyin	CVE-2021-4139İstismar yok	Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore · pimcore · CWE-79 XSS	Kritik9,0	—	%0,9	21 Ara 2021
36İzleyin	CVE-2024-24822İstismar yok	Pimcore Admin Classic Bundle permissions are not getting checked when working with tagspimcore · admin classic bundle · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,1	—	%0,5	7 Şub 2024
35İzleyin	CVE-2018-14058Silahlaştırılmış	Pimcore before 5.3.0 allows SQL Injection via the REST web service API.pimcore · pimcore · CWE-89 SQL enjeksiyonu	Orta6,5	—	%29,0	17 Ağu 2018
35İzleyin	CVE-2022-0258İstismar yok	SQL Injection in pimcore/pimcorepimcore · pimcore · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%1,7	17 Oca 2022
35İzleyin	CVE-2019-16318İstismar yok	In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstpimcore · pimcore · CWE-434 Dosya yükleme	Yüksek8,8	—	%1,4	14 Eyl 2019
35İzleyin	CVE-2023-47637İstismar yok	SQL Injection in Admin Grid Filter API in Pimcorepimcore · pimcore · CWE-89 RCE SQL enjeksiyonu	Yüksek8,8	—	%1,2	15 Kas 2023
35İzleyin	CVE-2021-37702İstismar yok	Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcorepimcore · pimcore · CWE-1236	Yüksek8,8	—	%1,1	18 Ağu 2021
35İzleyin	CVE-2024-23646İstismar yok	Pimcore Admin Classic Bundle SQL Injection in Admin download files as zippimcore · admin classic bundle · CWE-89 RCE SQL enjeksiyonu	Yüksek8,8	—	%1,0	24 Oca 2024
35İzleyin	CVE-2023-25240İstismar yok	An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.pimcore · pimcore · CWE-1265 pre-auth RCE	Yüksek8,8	—	%1,0	13 Şub 2023
35İzleyin	CVE-2023-2983İstismar yok	Privilege Defined With Unsafe Actions in pimcore/pimcorepimcore · pimcore · CWE-267	Yüksek8,8	—	%0,9	30 May 2023
35İzleyin	CVE-2023-2338İstismar yok	SQL Injection in pimcore/pimcorepimcore · pimcore · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%0,9	27 Nis 2023
35İzleyin	CVE-2023-2984İstismar yok	Path Traversal: '\..\filename' in pimcore/pimcorepimcore · pimcore · CWE-29 Yol geçişi	Yüksek8,8	—	%0,9	30 May 2023
35İzleyin	CVE-2024-23648İstismar yok	Pimcore Admin Classic Bundle host header injection in the password resetpimcore · admin classic bundle · CWE-74 Kimlik doğrulamasız	Yüksek8,8	—	%0,8	24 Oca 2024
35İzleyin	CVE-2023-30850İstismar yok	Pimcore SQL Injection Vulnerability in Admin Translations APIpimcore · pimcore · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%0,8	27 Nis 2023

CVE-2019-10867
56Planlayın
An issue was discovered in Pimcore before 5.7.1.
YüksekCVSS 8,8SilahlaştırılmışEPSS %69
- Deserializasyon
pimcore · pimcore4 Nis 2019
CVE-2023-1578
54Planlayın
SQL Injection in pimcore/pimcore
YüksekCVSS 8,8İstismar yokEPSS %63
- SQL enjeksiyonu
pimcore · pimcore22 Mar 2023
CVE-2022-1429
49Planlayın
SQL injection in GridHelperService.php in pimcore/pimcore
YüksekCVSS 7,5İstismar yokEPSS %64
- Kimlik doğrulamasız
- SQL enjeksiyonu
pimcore · pimcore22 Nis 2022
CVE-2022-0832
41Planlayın
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
OrtaCVSS 5,4İstismar yokEPSS %67
- XSS
pimcore · pimcore4 Mar 2022
CVE-2022-39365
40Planlayın
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
KritikCVSS 9,8İstismar yokEPSS %2
- pre-auth RCE
- SSTI
pimcore · pimcore27 Eki 2022
CVE-2019-18985
39İzleyin
Pimcore before 6.2.2 lacks brute force protection for the 2FA token.
KritikCVSS 9,8İstismar yokEPSS %1
- Kimlik doğrulamasız
pimcore · pimcore15 Kas 2019
CVE-2019-18981
39İzleyin
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
KritikCVSS 9,8İstismar yokEPSS %1
- Kimlik doğrulamasız
pimcore · pimcore15 Kas 2019
CVE-2024-25625
37İzleyin
Pimcore Host Header Injection in user invitation link
KritikCVSS 9,3İstismar yokEPSS %1
- Kimlik doğrulamasız
pimcore · admin classic bundle19 Şub 2024
CVE-2018-14057
36İzleyin
Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-
YüksekCVSS 8,8Kavram kanıtıEPSS %3
- Kimlik doğrulamasız
- CSRF
pimcore · pimcore17 Ağu 2018
CVE-2021-23405
36İzleyin
This affects the package pimcore/pimcore before 10.0.7.
YüksekCVSS 8,8İstismar yokEPSS %2
- SQL enjeksiyonu
pimcore · pimcore9 Tem 2021
CVE-2019-16317
36İzleyin
In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter
YüksekCVSS 8,8İstismar yokEPSS %2
- Deserializasyon
pimcore · pimcore14 Eyl 2019
CVE-2021-4139
36İzleyin
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
KritikCVSS 9,0İstismar yokEPSS %1
- XSS
pimcore · pimcore21 Ara 2021
CVE-2024-24822
36İzleyin
Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
KritikCVSS 9,1İstismar yokEPSS %1
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
pimcore · admin classic bundle7 Şub 2024
CVE-2018-14058
35İzleyin
Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
OrtaCVSS 6,5SilahlaştırılmışEPSS %29
- SQL enjeksiyonu
pimcore · pimcore17 Ağu 2018
CVE-2022-0258
35İzleyin
SQL Injection in pimcore/pimcore
YüksekCVSS 8,8İstismar yokEPSS %2
- SQL enjeksiyonu
pimcore · pimcore17 Oca 2022
CVE-2019-16318
35İzleyin
In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonst
YüksekCVSS 8,8İstismar yokEPSS %1
- Dosya yükleme
pimcore · pimcore14 Eyl 2019
CVE-2023-47637
35İzleyin
SQL Injection in Admin Grid Filter API in Pimcore
YüksekCVSS 8,8İstismar yokEPSS %1
- RCE
- SQL enjeksiyonu
pimcore · pimcore15 Kas 2023
CVE-2021-37702
35İzleyin
Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore
YüksekCVSS 8,8İstismar yokEPSS %1
pimcore · pimcore18 Ağu 2021
CVE-2024-23646
35İzleyin
Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
YüksekCVSS 8,8İstismar yokEPSS %1
- RCE
- SQL enjeksiyonu
pimcore · admin classic bundle24 Oca 2024
CVE-2023-25240
35İzleyin
An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.
YüksekCVSS 8,8İstismar yokEPSS %1
- pre-auth RCE
pimcore · pimcore13 Şub 2023
CVE-2023-2983
35İzleyin
Privilege Defined With Unsafe Actions in pimcore/pimcore
YüksekCVSS 8,8İstismar yokEPSS %1
pimcore · pimcore30 May 2023
CVE-2023-2338
35İzleyin
SQL Injection in pimcore/pimcore
YüksekCVSS 8,8İstismar yokEPSS %1
- SQL enjeksiyonu
pimcore · pimcore27 Nis 2023
CVE-2023-2984
35İzleyin
Path Traversal: '\..\filename' in pimcore/pimcore
YüksekCVSS 8,8İstismar yokEPSS %1
- Yol geçişi
pimcore · pimcore30 May 2023
CVE-2024-23648
35İzleyin
Pimcore Admin Classic Bundle host header injection in the password reset
YüksekCVSS 8,8İstismar yokEPSS %1
- Kimlik doğrulamasız
pimcore · admin classic bundle24 Oca 2024
CVE-2023-30850
35İzleyin
Pimcore SQL Injection Vulnerability in Admin Translations API
YüksekCVSS 8,8İstismar yokEPSS %1
- SQL enjeksiyonu
pimcore · pimcore27 Nis 2023