CVE-2016-6201

CVE-2016-6201 affects Ektron Content Management System (CMS) before 9.1.0.184 SP3. The flaw allows remote attackers to inject arbitrary web script/HTML via the ContType parameter in ViewContentByCategory under WorkArea/content.aspx, i.e., a cross-site scripting (XSS) vector. The vulnerability is ...

CVE-2016-6201

Cross-site scripting XSS vulnerability in Ektron Content Management System CMS before 9.1.0.184 SP3 9.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the ContType parameter in a ViewContentByCategory action to WorkArea/content.aspx...

Ektron CMS 9.10SP1 Cross Site Scripting

Vulnerability type: Cross Site Scripting Vendor: Ektron Product: Ektron Content Management System Affected version: 9.10SP1Build 9.1.0.184 Patched version: 9.1.0.184SP39.1.0.184.3.127 Credit: Siyavash Ghasseminia, Edmund Goh CVE ID: CVE-2016-6133 PROOF OF CONCEPT Vulnerable URL:...

Ektron 8.5 / 8.7 / 9.0 XSLT Transform Remote Code Execution Exploit

Ektron versions 8.5, 8.7 equal to and below sp1, and 9.0 before sp1 have vulnerabilities in various operations within the ServerControlWS.asmxweb services. These vulnerabilities allow for remote code execution without authentication and execute in the context of IIS on the remote system. This...

Ektron 8.5 / 8.7 / 9.0 XSLT Transform Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution', 'Description' = %q Ektron 8.5, 8.7 'catatonicprime' , 'License' =...

Ektron CMS 9.10 SP1 (Build 9.1.0.184.1.114) - CSRF Vulnerability

Exploit for php platform in category web applications Vulnerability type: Cross-site Request Forgery Vendor: http://www.ektron.com/ Product: Ektron Content Management System Affected version: = TIMELINE – 07/04/2015: Vulnerability found – 07/04/2015: Vendor informed – 08/04/2015: Vendor responded...

Ektron CMS 9.10 SP1 (Build 9.1.0.184.1.114) - Cross-Site Request Forgery

Vulnerability type: Cross-site Request Forgery Vendor: http://www.ektron.com/ Product: Ektron Content Management System Affected version: = TIMELINE – 07/04/2015: Vulnerability found – 07/04/2015: Vendor informed – 08/04/2015: Vendor responded and acknowledged - 01/05/2015: MITRE issued CVE...

Ektron CMS 9.10 SP1 (Build 9.1.0.184.1.114) - Cross-Site Request Forgery

Ektron CMS 9.10 SP1 Build 9.1.0.184.1.114 - Cross-Site Request Forgery Vulnerability type: Cross-site Request Forgery Vendor: http://www.ektron.com/ Product: Ektron Content Management System Affected version: = TIMELINE – 07/04/2015: Vulnerability found – 07/04/2015: Vendor informed – 08/04/2015:...

Ektron Content Management System Cross-Site Scripting Vulnerability

Ektron Content Management System is an enterprise-level Web content management system. A cross-site scripting vulnerability exists in Test/WorkArea/workarea.aspx in Ektron CMS, which can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitiv...

CVE-2015-4427

Multiple cross-site scripting XSS vulnerabilities in Test/WorkArea/workarea.aspx in Ektron Content Management System CMS before 9.10 SP1 Build 9.1.0.184.1.114 allow remote authenticated users to inject arbitrary web script or HTML via the 1 page, 2 action, 3 folderid, or 4 LangType parameter...

CVE-2015-3624

Cross-site request forgery CSRF vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System CMS before 9.10 SP1 Build 9.1.0.184.1.120 allows remote attackers to hijack the authentication of content administrators for requests that delete content via a...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System CMS before 9.10 SP1 Build 9.1.0.184.1.120 allows remote attackers to hijack the authentication of content administrators for requests that delete content via a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Test/WorkArea/workarea.aspx in Ektron Content Management System CMS before 9.10 SP1 Build 9.1.0.184.1.114 allow remote authenticated users to inject arbitrary web script or HTML via the 1 page, 2 action, 3 folderid, or 4 LangType parameter...

CVE-2015-4427

Multiple cross-site scripting XSS vulnerabilities in Test/WorkArea/workarea.aspx in Ektron Content Management System CMS before 9.10 SP1 Build 9.1.0.184.1.114 allow remote authenticated users to inject arbitrary web script or HTML via the 1 page, 2 action, 3 folderid, or 4 LangType parameter...

CVE-2015-3624

Cross-site request forgery CSRF vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System CMS before 9.10 SP1 Build 9.1.0.184.1.120 allows remote attackers to hijack the authentication of content administrators for requests that delete content via a...

CVE-2015-4427

CVE-2015-4427 affects Ektron Content Management System in versions before 9.10 SP1 (Build 9.1.0.184.1.114). The vulnerability is cross-site scripting (XSS) in Test/WorkArea/workarea.aspx, exploitable by remote authenticated users via the (1) page, (2) action, (3) folder_id, or (4) LangType parame...

CVE-2015-3624

CVE-2015-3624 describes a CSRF vulnerability in Ektron Content Management System (CMS) prior to 9.10 SP1 (Build 9.1.0.184.1.120). The flaw is in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx and can allow an attacker to hijack a content administrator’s authenticated session to perform a dele...

Ektron Cross-Site Request Forgery Vulnerability

Ektron is an enterprise-level Web content management system. A cross-site request forgery vulnerability exists in Ektron that allows remote attackers to construct malicious URIs and trick users into parsing them, which can perform malicious actions in the context of the target user...

Ektron CMS 9.10 SP1 - XSS Vulnerability

Vulnerability type: Cross-site Scripting Vendor: http://www.ektron.com/ Product: Ektron Content Management System Affected version: = 9.10 SP1 Build 9.1.0.184.1.102 Patched version: 9.10 SP1 Build 9.1.0.184.1.114 Credit: Jerold Hoong PROOF OF CONCEPT XSS Cross-site scripting XSS vulnerability in...

Multiple Cross-Site Scripting Vulnerabilities in Ektron CMS

Ektron CMS is a content management system. Multiple cross-site scripting vulnerabilities exist in Ektron CMS due to the program failing to adequately filter user-submitted input. The vulnerabilities could be exploited to allow an attacker to steal cookie-based authentication credentials and execu...