Vulnerabilities

TI-2020-15032 CVE-2020-24550 · GHSA-384j-85hc-jfq2

An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to…

LOW 35

An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirect parameter in a crafted URL, such as a /find_v2/_click URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04719 Published 2021-03-31 No fix listed CWE-601

TI-2018-09042 CVE-2018-12596 · GHSA-pp88-5vm8-r9cr

Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before…

MEDIUM 62

Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /Wo…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.22379 Published 2018-10-10 No fix listed CWE-269

TI-2017-13003 CVE-2017-17762 · GHSA-qvv4-58rx-f26c

XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote…

MEDIUM 40

XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary files via a crafted DTD in an XML request involving util/xmlrpc/Handler.ashx.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04648 Published 2018-08-29 No fix listed CWE-611

TI-2012-00946 CVE-2012-1032 · GHSA-49pj-5fpc-q7mf

Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before…

LOW 22

Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01161 Published 2014-09-17 No fix listed CWE-79

TI-2012-00948 CVE-2012-1034 · GHSA-p38m-v775-pv97

Multiple cross-site scripting (XSS) vulnerabilities in the admin interface in EPiServer…

LOW 22

Multiple cross-site scripting (XSS) vulnerabilities in the admin interface in EPiServer CMS through 6R2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01053 Published 2012-02-08 No fix listed CWE-79

TI-2012-00945 CVE-2012-1031 · GHSA-r38m-g3v3-7w4j

Unspecified vulnerability in EPiServer CMS 5 and 6 through 6R2, in certain configurations…

LOW 29

Unspecified vulnerability in EPiServer CMS 5 and 6 through 6R2, in certain configurations using Forms Authentication, allows remote authenticated users to obtain WebAdmins access by leveraging Edit Mode privileges, a dif…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.01024 Published 2012-02-08 No fix listed