CVE-2024-48202

The IceCMS content management system (versions 3.4.7 and earlier ) contains a File Upload vulnerability in the uploadFile method of FileUtils.java. The root cause is a lack of validation for uploaded files, which allows an attacker to upload malicious files and achieve remote code execution (RCE)...

PT-2024-33023 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: icecms versions 3.4.7 and earlier Description: The issue is related to a File Upload vulnerability. It affects the uploadFile function in FileUtils.java. Recommendations: For versions 3.4.7 and earlier, update to a version later than 3.4.7 to...

IceCMS Authentication Error Vulnerability

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation . An authentication bypass vulnerability exists in IceCMS v3.4.7 and earlier versions, which stems from the inclusion of hard-coded JWT keys that can be exploited by an attacker to forge JWT...

CVE-2024-46610

An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to the endpoint /User/ChangeUser/s in the ChangeUser function in UserController.java...

CVE-2024-46612

IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information...

CVE-2024-46609

An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, including passwords...

CVE-2024-46607

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file...

CVE-2024-46607

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file...

CVE-2024-46612

IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information...

IceCMS security vulnerabilities

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation by NgShow individual developers. A security vulnerability exists in IceCMS v3.4.7 and earlier versions, which stems from an access control issue that allows an unauthenticated attacker to access and...

IceCMS security vulnerabilities

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation by NgShow individual developers. A security vulnerability exists in IceCMS v3.4.7 and earlier versions, which stems from an access control issue that allows an attacker to arbitrarily modify user...

CVE-2024-46612: Use of Hard-coded Cryptographic Key

IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information...

CVE-2024-46609: Improper Access Control

An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, including passwords...

CVE-2024-46610: Improper Access Control

An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to the endpoint /User/ChangeUser/s in the ChangeUser function in UserController.java...

CVE-2024-46607: Improper Access Control

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file...

IceCMS security vulnerabilities

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation by NgShow individual developers. A security vulnerability exists in IceCMS 3.4.7 and earlier versions, which stems from the presence of an incorrect privilege modification that allows an attacker to...

IceCMS security vulnerabilities

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation . An authentication bypass vulnerability exists in IceCMS v3.4.7 and earlier versions, which stems from the inclusion of hard-coded JWT keys that can be exploited by an attacker to forge JWT...

PT-2024-32072 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS versions 3.4.7 and earlier Description: The issue allows attackers to bypass authentication by entering arbitrary values as the username and password via the loginAdmin method in the UserController.java file. This enables unauthorized...

PT-2024-32076 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS versions 3.4.7 and earlier Description: The issue allows an attacker to forge JWT authentication information due to a hardcoded JWT key. Recommendations: For IceCMS versions 3.4.7 and earlier, update to a version that does not contain...

PT-2024-32075 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS versions 3.4.7 and earlier Description: The issue allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to the endpoint "/User/ChangeUser/s" in the ChangeUser functi...