Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Umbraco_cms
(Umbraco)| Repositories |
• https://github.com/umbraco/Umbraco-CMS
• https://github.com/Umbraco/Umbraco-CMS |
| #Vulnerabilities | 40 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2025-01-21 | CVE-2025-24011 | Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and 15.1.2 contain a patch. No known workarounds are available. | Umbraco_cms | 5.3 | ||
| 2025-01-21 | CVE-2025-24012 | Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 contain a patch. | Umbraco_cms | 5.4 | ||
| 2024-03-20 | CVE-2024-28868 | Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins. | Umbraco_cms | 5.3 | ||
| 2024-04-17 | CVE-2024-29035 | Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1. | Umbraco_cms | 5.3 |