Advisories · Technology
Concrete CMS.
Every CVE that names Concrete CMS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.3 Medium
Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.
- Concrete CMS
- Broken access control
- CWE-640
- CVSS 6.3 Medium
Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).
- Concrete CMS
- Broken access control
- CVSS 5.3 Medium
Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller
- Concrete CMS
- Cross-site request forgery (CSRF)
- CVSS 5.9 Medium
Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog
- Concrete CMS
- Broken access control
- CVSS 6.3 Medium
Concrete CMS before 9.5.3 is vulnerable to Missing Authorization in Stack/Container Sub-Block Asset Registration
- Concrete CMS
- Broken access control
-
Concrete CMS: A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS…
- Concrete CMS