CVE-2023-51350

A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-For function in the header...

CVE-2023-34747

File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload...

CVE-2023-34865

Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature...

CVE-2023-34878

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

CVE-2023-34878

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

CVE-2023-34865

Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature...

CVE-2023-34865

Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature...

CVE-2023-34747

File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload...

Directory traversal

Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature...

Unrestricted file upload

File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload...

Hardcoded credentials

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

CVE-2023-3231

A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component ZIP Package Handler. The manipulation of the argument dir leads to information disclosure. The attack can be initiated remotely. The complexity of an attack ...

Information disclosure

A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component ZIP Package Handler. The manipulation of the argument dir leads to information disclosure. The attack can be initiated remotely. The complexity of an attack ...

CVE-2023-3231 UJCMS ZIP Package information disclosure

A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component ZIP Package Handler. The manipulation of the argument dir leads to information disclosure. The attack can be initiated remotely. The complexity of an attack ...

CVE-2023-3231

CVE-2023-3231 affects UJCMS up to version 6.0.2, specifically the ZIP Package Handler’s dir parameter, enabling information disclosure through remote access. The vulnerability arises from manipulation of the dir argument in unknown ZIP Package Handler code; exploitation is reportedly difficult bu...

CVE-2023-34865

CVE-2023-34865 affects ujcms 6.0.2 with a directory traversal flaw that allows moving files via the rename feature. The issue is documented across multiple feeds; endpoints and/or components involved are the ujcms rename path and file moves. Impact is high (CVE/CVSS: Critical) per the primary ent...

UJCMS 安全漏洞

UJCMS is UJCMS open source a Java open source content management system . A security vulnerability exists in UJCMS v6.0.2. An attacker exploited the vulnerability to obtain sensitive information via the dir parameter of /api/backend/core/web-file-html/download-zip...

PT-2023-24994 · Ujcms · Ujcms

Name of the Vulnerable Software and Affected Versions: ujcms version 6.0.2 Description: The issue concerns a file upload vulnerability. It is exploited via the "/api/backend/core/web-file-upload/upload" API endpoint. Recommendations: For ujcms version 6.0.2, consider restricting access to the...

PT-2023-25044 · Ujcms · Ujcms

Name of the Vulnerable Software and Affected Versions: Ujcms version 6.0.2 Description: An issue in Ujcms allows attackers to gain sensitive information via the dir parameter to the "/api/backend/core/web-file-html/download-zip" API endpoint. Recommendations: For Ujcms version 6.0.2, as a tempora...

CVE-2023-34878

CVE-2023-34878 affects Ujcms v6.0.2, where the dir parameter in the endpoint "/api/backend/core/web-file-html/download-zip" can cause leakage of sensitive information. The CVSS v3.1 base score is 7.5 (HIGH) with NETWORK access, LOW attack complexity, NONE privileges, NONE user interaction, and CO...