Cross site scripting

An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/login.php has Reflected XSS via the xduserformalname parameter...

Path traversal

An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/dlpublication.php allows Path traversal via the file parameter, allowing remote attackers to read PDF files in arbitrary directories...

CVE-2018-16988

Open XDMoD

CVE-2018-16988

An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass account takeover exists due to a weak password reset mechanism. A brute-force attack against an MD5 rid value requires only 600 guesses in the plausible situation where the attacker knows that the victim has started a...

CVE-2018-16961

An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/dlpublication.php allows Path traversal via the file parameter, allowing remote attackers to read PDF files in arbitrary directories...

CVE-2018-16961

CVE-2018-16961 affects Open XDMoD up to version 7.5.0, where the file parameter in html/gui/general/dl_publication.php allows path traversal, enabling remote attackers to read PDF files in arbitrary directories. Root cause: improper validation of the file parameter leading to directory traversal....

CVE-2018-16960

An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/login.php has Reflected XSS via the xduserformalname parameter...

CVE-2018-16960

Open XDMoD

PT-2019-9388

Name of the Vulnerable Software and Affected Versions Open XDMoD versions prior to 7.5.0 Description An issue exists due to a weak password reset mechanism, allowing for an authentication bypass, which can lead to account takeover. In a plausible scenario where the attacker is aware that the vict...