124 matches found
Ektron CMS 9.20 SP2 - Improper Access Restrictions
Ektron CMS 9.20 SP2 - Improper Access Restrictions Details ================ Software: Ektron Content Management System CMS Version: 9.20 SP2 Homepage: https://www.episerver.com Advisory report: https://github.com/alt3kx/CVE-2018-12596 CVE: CVE-2018-12596 CVSS: 7.5 HIGH:...
Ektron CMS 9.20 SP2 - Improper Access Restrictions
Details ================ Software: Ektron Content Management System CMS Version: 9.20 SP2 Homepage: https://www.episerver.com Advisory report: https://github.com/alt3kx/CVE-2018-12596 CVE: CVE-2018-12596 CVSS: 7.5 HIGH: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-284 Description ================ Ektr...
Ektron Content Management System (CMS) Remote Re-enablement User Vulnerability
Ektron Content Management System is an enterprise-level Web content management system from Ektron, Inc. A remote re-enablement user vulnerability exists in Ektron Content Management System CMS version 9.20 SP2, which allows remote attackers to exploit the vulnerability to enable users...
Design/Logic Flaw
Ektron Content Management System CMS before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data...
CVE-2012-5357
Ektron Content Management System CMS before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data...
CVE-2012-5358
The XSLTCompiledTransform function in Ektron Content Management System CMS before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or...
Authentication flaw
The XSLTCompiledTransform function in Ektron Content Management System CMS before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or...
CVE-2012-5357
CVE-2012-5357 affects Ektron CMS prior to 8.02 SP5. The vulnerability arises from XslCompiledTransform with enablescript set to true, allowing remote code execution with NETWORK SERVICE privileges via crafted XSL data. Documentation and third-party sources confirm RCE potential in Ektron’s XSLT h...
CVE-2012-5358
Affected software: Ektron Content Management System (CMS) prior to 8.02 SP5. Vulnerable component: XslCompiledTransform/XSLT processing configured with insecure flags (enableDocumentFunction or enablescript) in ekajaxtransform.aspx. Root cause: Improper XSLT handling allows crafted XSL data to tr...
CVE-2012-5358
The XSLTCompiledTransform function in Ektron Content Management System CMS before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or...
CVE-2012-5357
Ektron Content Management System CMS before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data...
Ektron Content Management System Cross-Site Scripting Vulnerability
Ektron Content Management System is an enterprise-level Web content management system from Ektron, Inc. A cross-site scripting vulnerability exists in the Ektron Content Management System, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtai...
CVE-2016-6133
Cross-site scripting XSS vulnerability in Ektron Content Management System before 9.1.0.184SP39.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the rptStatus parameter in a Report action to WorkArea/SelectUserGroup.aspx...
CVE-2016-6133
Cross-site scripting XSS vulnerability in Ektron Content Management System before 9.1.0.184SP39.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the rptStatus parameter in a Report action to WorkArea/SelectUserGroup.aspx...
Cross site scripting
Cross-site scripting XSS vulnerability in Ektron Content Management System before 9.1.0.184SP39.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the rptStatus parameter in a Report action to WorkArea/SelectUserGroup.aspx...
CVE-2016-6133
CVE-2016-6133 is an XSS vulnerability in Ektron Content Management System (pre-9.1.0.184SP3 / 9.1.0.184.3.127) where an attacker can inject arbitrary script via the rptStatus parameter in WorkArea/SelectUserGroup.aspx. Public details (PacketStorm) show affected version 9.10SP1 (build 9.1.0.184) a...
CVE-2016-6133
Cross-site scripting XSS vulnerability in Ektron Content Management System before 9.1.0.184SP39.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the rptStatus parameter in a Report action to WorkArea/SelectUserGroup.aspx...
Ektron Content Management System Cross-Site Scripting Vulnerability
Ektron Content Management System CMS is an enterprise-class Web content management system CMS from Ektron, Inc. The system supports WYSIWYG editors, content layout and drag-and-drop operations. A cross-site scripting vulnerability exists in versions of Ektron CMS prior to 9.1.0.184 SP3...
CVE-2016-6201
Cross-site scripting XSS vulnerability in Ektron Content Management System CMS before 9.1.0.184 SP3 9.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the ContType parameter in a ViewContentByCategory action to WorkArea/content.aspx...
CVE-2016-6201
Cross-site scripting XSS vulnerability in Ektron Content Management System CMS before 9.1.0.184 SP3 9.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the ContType parameter in a ViewContentByCategory action to WorkArea/content.aspx...