CVE-2019-9613: Unrestricted Upload of File with Dangerous Type

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadVideo URI...

PT-2019-19752

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue allows remote attackers to execute arbitrary code. The blocking of .jsp and .jspx files does not consider files with alternative data streams, such as file.jsp::$DATA, when accessing the...