627 matches found
PT-2021-16892
Name of the Vulnerable Software and Affected Versions OpenCMS versions 10.5.0 through 11.0.2 Description The issue allows low privileged application users to store malicious scripts in the Sitemap functionality. These scripts are executed in a victim’s browser when they open the page containing t...
Alkacon Software OpenCms cross-site scripting vulnerabilities
Alkacon Software OpenCms is a professional, open source, easy-to-use web content management system from Alkacon Software, Germany. A cross-site scripting vulnerability exists in Alkacon Software OpenCMS versions 10.5.0 through 11.0.2, which allows a user with a low-privileged application to store...
GHSA-G6V7-VQHX-6V6C XML External Entity Reference in org.opencms:opencms-core
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
XML External Entity Reference in org.opencms:opencms-core
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
Alkacon OpenCms XML External Entity Vulnerability
Alkacon OpenCms is an open source content management system CMS developed in Java.Alkacon OpenCms is vulnerable to an XML external entity vulnerability that can be exploited by attackers to steal files from the server's file system by uploading crafted SVG documents...
CVE-2021-3312
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
CVE-2021-3312
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
Xxe
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
CVE-2021-3312
CVE-2021-3312 describes an XML External Entity (XXE) vulnerability in Alkacon OpenCms (11.0, 11.0.1, 11.0.2). The underlying issue allows remote authenticated users with edit privileges to exfiltrate files from the server’s filesystem by uploading a crafted SVG document. The vulnerability is tied...
CVE-2021-3312
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
CVE-2021-3312
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
CVE-2021-3312: Improper Restriction of XML External Entity Reference
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
PT-2021-20053
Name of the Vulnerable Software and Affected Versions Alkacon OpenCms versions 11.0 through 11.0.2 Description An XML external entity XXE issue allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
Alkacon OpenCms code-related vulnerabilities
Alkacon OpenCms is an open source content management system CMS developed in Java.Alkacon OpenCms is vulnerable to an XML external entity vulnerability that can be exploited by attackers to steal files from the server's file system by uploading crafted SVG documents...
de.eonas.portal:opencmsinstaller (>=9.0.0.1, <=9.5.2.0), de.eonas.portal:opencmsportaldriver (>=9.5.1.0, <=9.5.2.0) +22 more potentially affected by CVE-2021-29262 via org.apache.solr:solr-core (4.3.0)
org.apache.solr:solr-core MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - de.eonas.portal:opencmsinstaller =9.0.0.1, =9.5.1.0, =9.0.1, =9.0.0, =9.0.1, =9.0.0, =9.0.1, =9.0.0, =9.0.0,...
OpenCMS 11.0.2 Cross Site Request Forgery / Open Redirection
OpenCMS v11.0.2 -------------------------------------------------------------------------------------------------------------------------------------------------- CSRF - Login page vulnerable https://vulnerablehost.com/system/login - CSRF needs valid JSESSIONID to work, maybe logged Admin user...
OpenCMS 11.0.2 Cross Site Request Forgery / Open Redirection Vulnerability
OpenCMS v11.0.2 -------------------------------------------------------------------------------------------------------------------------------------------------- CSRF - Login page vulnerable https://vulnerablehost.com/system/login - CSRF needs valid JSESSIONID to work, maybe logged Admin user...
XML Entity Injection Vulnerability in Alkacon OpenCms
Alkacon OpenCms is a set of open source content management system CMS developed using the Java language . Alkacon OpenCms suffers from an XML entity injection vulnerability that can be exploited by an attacker to access server resources...
org.opencms:opencms (5.0.1) potentially affected by CVE-2019-2692 via mysql:mysql-connector-java (3.0.8)
mysql:mysql-connector-java MAVEN version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on mysql:mysql-connector-java and may be impacted: - org.opencms:opencms 5.0.1 Source cves: CVE-2019-2692 Source advisory: OSV:GHSA-JCQ3-CPRP-M333...
opencms.996256.n3.nabble.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1185476 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...