510 matches found
CVE-2018-8815
Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...
CVE-2018-8815
Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...
CVE-2018-8815
Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...
CVE-2018-8815
CVE-2018-8815 concerns Alkacon OpenCMS 10.5.3 where the gallery feature is vulnerable to cross-site scripting (XSS). A remote attacker can inject arbitrary web script or HTML by supplying a malicious SVG image, due to an underlying issue in the gallery function. The available sources confirm the ...
CVE-2018-8811
OpenCMS 10.5.3 is affected by a CSRF vulnerability in system/workplace/admin/accounts/user_role.jsp that can lead to privilege escalation by hijacking an admin session. Exploitation requires the attacker to have a CMS account with content-manager privileges; multiple public exploits (Exploit-DB, ...
CVE-2018-8811
Cross-site request forgery CSRF vulnerability in system/workplace/admin/accounts/userrole.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. Note: It is argued that OpenCMS allows only registered users...
CVE-2018-8815
Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...
CVE-2018-8811: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in system/workplace/admin/accounts/userrole.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. Note: It is argued that OpenCMS allows only registered users...
PT-2018-18636 · Opencms · Opencms
Name of the Vulnerable Software and Affected Versions: OpenCMS version 10.5.3 Description: A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. The system stores uploaded content, such ...
CVE-2018-8815: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...
OpenCms 9.5.2 Cross Site Scripting
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-063 Product: OpenCms Official Maintainer: Alkacon Software GmbH Affected Versions: 9.5.2 Tested Versions: 9.5.2 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Maintainer Notification:...
Alkacon OpenCms 9.5.1 Multiple XSS Vulnerabilities
Product: OpenCms Vendor: Alkacon Software Vulnerable Versions: 9.5.1 and probably prior Tested Version: 9.5.1 Vendor Notification: Mar 05, 2015 https://github.com/alkacon/opencms-core/issues/304 Vendor Patch: Not Yet No Specific Time-line Public Disclosure: Mar 12, 2015 Vulnerability Type:...
CVE-2015-2351
Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...
CVE-2015-2351
Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...
CVE-2015-2351
CVE-2015-2351 describes multiple XSS flaws in Alkacon OpenCms 9.5.1 and earlier caused by insufficient input filtering. Attackers can inject arbitrary script/HTML via five vectors: homelink in system/modules/org.opencms.workplace.help/jsptemplates/help_head.jsp; workplaceresource in system/workpl...
CVE-2015-2351: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...
Alkacon OpenCms suffers from multiple cross-site scripting vulnerabilities (CNVD-2015-01811)
OpenCms is a professional level open source web content management system. Multiple cross-site scripting vulnerabilities exist in Alkacon OpenCms 9.5.1 and prior versions because it fails to properly filter user-supplied input, allowing an attacker to exploit the vulnerabilities to execute...
Alkacon OpenCms 9.5.1 Cross Site Scripting
Product: OpenCms Vendor: Alkacon Software Vulnerable Versions: 9.5.1 and probably prior Tested Version: 9.5.1 Vendor Notification: Mar 05, 2015 https://github.com/alkacon/opencms-core/issues/304 Vendor Patch: Not Yet No Specific Time-line Public Disclosure: Mar 12, 2015 Vulnerability Type:...
