EUVD-2015-0939

Malware in sbrugna...

EUVD-2012-5279

Malware in sbrugna...

EUVD-2016-7067

Malware in sbrugna...

EUVD-2016-7134

Malware in sbrugna...

CVE-2012-5358: Undefined Security Weakness

The XSLTCompiledTransform function in Ektron Content Management System CMS before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or...

CVE-2012-5357: Undefined Security Weakness

Ektron Content Management System CMS before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data...

PT-2017-5207

Name of the Vulnerable Software and Affected Versions: Ektron Content Management System CMS versions prior to 8.02 SP5 Description: The issue allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data, due to the use of the XslCompiledTransform class wi...

PT-2017-5208

Name of the Vulnerable Software and Affected Versions: Ektron Content Management System CMS versions prior to 8.02 SP5 Description: The issue allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or possibly have...

CVE-2016-6133

CVE-2016-6133 is an XSS vulnerability in Ektron Content Management System (pre-9.1.0.184SP3 / 9.1.0.184.3.127) where an attacker can inject arbitrary script via the rptStatus parameter in WorkArea/SelectUserGroup.aspx. Public details (PacketStorm) show affected version 9.10SP1 (build 9.1.0.184) a...

PT-2017-8918

Name of the Vulnerable Software and Affected Versions Ektron Content Management System versions prior to 9.1.0.184SP39.1.0.184.3.127 Description The issue allows remote attackers to inject arbitrary web script or HTML via the rptStatus parameter in a Report action to...

CVE-2016-6133: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Ektron Content Management System before 9.1.0.184SP39.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the rptStatus parameter in a Report action to WorkArea/SelectUserGroup.aspx...

CVE-2016-6201

Cross-site scripting XSS vulnerability in Ektron Content Management System CMS before 9.1.0.184 SP3 9.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the ContType parameter in a ViewContentByCategory action to WorkArea/content.aspx...

CVE-2016-6201

CVE-2016-6201 affects Ektron Content Management System (CMS) before 9.1.0.184 SP3. The flaw allows remote attackers to inject arbitrary web script/HTML via the ContType parameter in ViewContentByCategory under WorkArea/content.aspx, i.e., a cross-site scripting (XSS) vector. The vulnerability is ...

CVE-2016-6201: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Ektron Content Management System CMS before 9.1.0.184 SP3 9.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the ContType parameter in a ViewContentByCategory action to WorkArea/content.aspx...

PT-2017-8931

Name of the Vulnerable Software and Affected Versions Ektron Content Management System CMS versions prior to 9.1.0.184 SP3 9.1.0.184.3.127 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the ContTy...

PT-2015-6245

Name of the Vulnerable Software and Affected Versions Ektron Content Management System CMS versions prior to 9.10 SP1 Build 9.1.0.184.1.120 Description The issue is related to a cross-site request forgery CSRF vulnerability. This vulnerability allows remote attackers to hijack the authentication ...

CVE-2015-4427: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Test/WorkArea/workarea.aspx in Ektron Content Management System CMS before 9.10 SP1 Build 9.1.0.184.1.114 allow remote authenticated users to inject arbitrary web script or HTML via the 1 page, 2 action, 3 folderid, or 4 LangType parameter...

PT-2015-6588

Name of the Vulnerable Software and Affected Versions Ektron Content Management System CMS versions prior to 9.10 SP1 Build 9.1.0.184.1.114 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via the page, action, folder id, or LangType parameters in the...

CVE-2015-3624: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System CMS before 9.10 SP1 Build 9.1.0.184.1.120 allows remote attackers to hijack the authentication of content administrators for requests that delete content via a...

Ektron CMS 9.10 SP1 - CSRF Vulnerability

Vulnerability type: Cross-site Request Forgery Vendor: http://www.ektron.com/ Product: Ektron Content Management System Affected version: = 9.10 SP1 Build 9.1.0.184.1.114 Patched version: 9.10 SP1 Build 9.1.0.184.1.120 CVE ID: CVE-2015-3624 Credit: Jerold Hoong PROOF OF CONCEPT CSRF Cross-site...