GCVE - cpe:2.3:a:progress:sitefinity:9.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:progress:sitefinity:9.1:*:*:*:*:*:*:*

part: a version: 9.1 update: *

Vendor	Progress (`f9d80521-f73f-5a85-8df9-9306f2f67809`)
Product	Sitefinity (`6a195a8a-67a9-5e8c-915e-555606d96b98`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-18179`	vulnerable	2026-06-08 05:09:10.532470	Details available Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a password change or a session termination. Also, it is transmitted as a GET parameter. This is fixed in 10.1. Published: 2018-02-12T14:00:00.000Z Updated: 2024-09-16T22:55:34.950Z Open on db.gcve.eu Reference links https://www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-progress-sitefinity/index.html https://packetstormsecurity.com/files/143894/Progress-Sitefinity-9.1-XSS-Session-Management-Open-Redirect.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-18178`	vulnerable	2026-06-08 05:09:10.532177	Details available Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, if the target is specified using a certain %40 syntax. This is fixed in 10.1. Published: 2018-02-12T14:00:00.000Z Updated: 2024-09-16T18:29:33.596Z Open on db.gcve.eu Reference links https://www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-progress-sitefinity/index.html https://packetstormsecurity.com/files/143894/Progress-Sitefinity-9.1-XSS-Session-Management-Open-Redirect.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-18177`	vulnerable	2026-06-08 05:09:10.531879	Details available Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1. Published: 2018-02-12T14:00:00.000Z Updated: 2024-09-16T18:39:37.546Z Open on db.gcve.eu Reference links https://www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-progress-sitefinity/index.html https://packetstormsecurity.com/files/143894/Progress-Sitefinity-9.1-XSS-Session-Management-Open-Redirect.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-18176`	vulnerable	2026-06-08 05:09:10.531559	Details available Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. This is fixed in 10.1. Published: 2018-02-12T14:00:00.000Z Updated: 2024-09-16T22:25:19.398Z Open on db.gcve.eu Reference links https://www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-progress-sitefinity/index.html https://packetstormsecurity.com/files/143894/Progress-Sitefinity-9.1-XSS-Session-Management-Open-Redirect.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-18175`	vulnerable	2026-06-08 05:09:10.531132	Details available Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src attribute of an IMG element. This is fixed in 10.1. Published: 2018-02-12T14:00:00.000Z Updated: 2024-09-16T18:38:47.409Z Open on db.gcve.eu Reference links https://www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-progress-sitefinity/index.html https://packetstormsecurity.com/files/143894/Progress-Sitefinity-9.1-XSS-Session-Management-Open-Redirect.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-15883`	vulnerable	2026-06-08 05:08:59.664986	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.