Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

UmbracoCms

7 known vulnerabilities (3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 3 medium, 1 low
Registry
NuGet

Advisories 7

  • CVE-2021-47776Medium 6.9

    Umbraco v8.14.1 - 'baseUrl' SSRF

    Affected: versions 8.14.1.

  • CVE-2024-48927Medium 4.6

    Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

    Affected: from 8.0.0, fixed in 8.18.15.

  • CVE-2024-48926Medium 4.2

    Umbraco CMS logout page displayed before session expiration

    Affected: from 8.0.0, fixed in 8.18.15.

  • Umbraco possible user enumeration vulnerability

    Affected: from 10.0.0, fixed in 10.8.5.

  • An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in…

    Affected: fixed in 8.9.2.

  • Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack…

    Affected: fixed in 8.10.0.

  • Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.

    Affected: fixed in 8.5.4.