CVE-2006-3934: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter...

CVE-2006-3936: Undefined Security Weakness

system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp...

CVE-2006-3935: Undefined Security Weakness

system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to 1 send broadcast messages to all users /workplace/broadcast, 2 list all users /accounts/users, 3 add webusers...

CVE-2006-3933: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Alkacon OpenCms before 6.2.2 allows remote authenticated users to inject arbitrary web script or HTML via the message body...

Cross site scripting

Cross-site scripting XSS vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action...

CVE-2006-2571

Cross-site scripting XSS vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action...

CVE-2006-2571

Cross-site scripting XSS vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action...

CVE-2006-2571

The CVE-2006-2571 entry refers to an XSS vulnerability in Alkacon OpenCms (versions 6.0.0, 6.0.2, 6.0.3) where arbitrary web script/HTML can be injected through the query parameter in a search action on search.html. This is triggered remotely via the vulnerable search feature, enabling script exe...

CVE-2006-2571: Undefined Security Weakness

Cross-site scripting XSS vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action...

CVE-2005-4294

Cross-site scripting XSS vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page...

CVE-2005-4294

Alkacon OpenCms

CVE-2005-4294

Cross-site scripting XSS vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page...

CVE-2005-4294: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page...

[Full-disclosure] [scip_Advisory 1910] Alkacon OpenCms 6.0.2 login Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alkacon OpenCms 6.0.2 login Cross Site Scripting scip AG Vulnerability Advisory ID 1910 11/22/2005 http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1910 I. INTRODUCTION Alkacon OpenCms is a professional level open source website content management syste...