CVE-2019-9616: Use of Incorrectly-Resolved Name or Reference

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadScrawl URI...

CVE-2019-9613: Unrestricted Upload of File with Dangerous Type

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadVideo URI...

PT-2019-19753

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description A command execution issue exists in OFCMS. This issue can be exploited via a template file using the freemarker.template.utility.Execute function, allowing an attacker to execute arbitrary commands. Th...

PT-2019-19748

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue allows remote attackers to execute arbitrary code. The blocking of .jsp and .jspx files does not consider certain file names, such as file.jsp::$DATA, which can be exploited through the...

PT-2019-19749

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue was discovered related to directory traversal. This issue is connected to the getTemplates function in TemplateController.java and can be exploited through the...

CVE-2019-9617: Unrestricted Upload of File with Dangerous Type

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadFile URI...