Concrete CMS 8.5.19

CPE Details

Concrete CMS 8.5.19
concretecms
concrete_cms
8.5.19
2025-01-27
18h57 +00:00
2025-01-27
18h57 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:concretecms:concrete_cms:8.5.19:*:*:*:*:*:*:*

Informations

Vendor

concretecms

Product

concrete_cms

Version

8.5.19

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2023-28471 2023-04-28 00h00 +00:00 Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name.
5.4
Medium
CVE-2023-28820 2023-04-28 00h00 +00:00 Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.
5.4
Medium
CVE-2023-28821 2023-04-28 00h00 +00:00 Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.
5.3
Medium
CVE-2023-28472 2023-04-27 22h00 +00:00 Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies.
5.3
Medium
CVE-2023-28473 2023-04-27 22h00 +00:00 Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section.
3.3
Low
CVE-2023-28474 2023-04-27 22h00 +00:00 Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.
5.4
Medium
CVE-2023-28475 2023-04-27 22h00 +00:00 Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.
6.1
Medium
CVE-2023-28476 2023-04-27 22h00 +00:00 Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.
5.4
Medium
CVE-2023-28477 2023-04-27 22h00 +00:00 Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.
5.5
Medium
CVE-2023-28819 2023-04-27 22h00 +00:00 Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.
5.4
Medium
CVE-2021-22954 2022-02-09 21h05 +00:00 A cross-site request forgery vulnerability exists in Concrete CMS
8.8
High