CVE-2019-9616

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadScrawl URI...

CVE-2019-9613

CVE-2019-9613 affects OFCMS prior to 1.1.3. The issue arises in the backend ueditor/uploadVideo handling where blocking of .jsp and .jspx files fails to consider file.jsp::$DATA, enabling remote attackers to execute arbitrary code via the admin/ueditor/uploadVideo URI. Documents consistently desc...

CVE-2019-9614

CVE-2019-9614 affects OFCMS prior to 1.1.3. A command injection vulnerability exists in a template file that uses ${ ex('') }, enabling execution of arbitrary commands. Multiple connected sources corroborate this flaw and specify that the vulnerability arises from a Freemarker-based template mec...