PT-2024-23521 · Unknown · Ametys Cms

Name of the Vulnerable Software and Affected Versions: Ametys CMS versions prior to 4.5.0 Description: The issue allows attackers to obtain sensitive information via exposed resources to the error scope. Recommendations: For Ametys CMS versions prior to 4.5.0, update to a version later than 4.5.0...

CVE-2022-26159

The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion//en.xml and similar pathnames for other languages, which contain all characters typed by all users, including the content of private...

CVE-2022-26159

The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion//en.xml and similar pathnames for other languages, which contain all characters typed by all users, including the content of private...

CVE-2022-26159

The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion//en.xml and similar pathnames for other languages, which contain all characters typed by all users, including the content of private...

Code injection

The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion//en.xml and similar pathnames for other languages, which contain all characters typed by all users, including the content of private...

CVE-2022-26159

Affected software. Ametys CMS before 4.5.0 with the auto-completion plugin. What is vulnerable. The plugin exposes read access to files like plugins/web/service/search/auto-completion//en.xml (and equivalents for other languages), which contain all characters typed by users. Impact. Private page ...

CVE-2022-26159

The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion//en.xml and similar pathnames for other languages, which contain all characters typed by all users, including the content of private...

PT-2022-17702 · Unknown · Ametys Cms

Name of the Vulnerable Software and Affected Versions: Ametys CMS versions prior to 4.5.0 Description: The auto-completion plugin in Ametys CMS allows a remote unauthenticated attacker to read documents, which contain all characters typed by all users, including the content of private pages. Thes...

Ametys Cms 信息泄露漏洞

Ametys Cms is used to run large enterprise websites, blogs, Intranet and Extranet on the same server.Ametys Community Cms a free open source content management system written in Java. An information disclosure vulnerability exists in the Ametys CMS auto-completion plugins, which originated in the...

Exploit for Forced Browsing in Ametys

CVE-2022-26159-Ametys-Autocompletion-XML A python exploi...

Ametys CMS v4.4.1 - Cross Site Scripting (XSS)

Exploit Title: Ametys CMS v4.4.1 - Cross Site Scripting XSS Exploit Author: Vulnerability-Lab Date: 21/01/2022 Document Title: =============== Ametys v4.4.1 CMS - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2275...

Ametys CMS 4.4.1 Cross Site Scripting Vulnerability

Document Title: =============== Ametys v4.4.1 CMS - Cross Site Scripting Vulnerability Product & Service Introduction: =============================== Build powerful and stunning websites. Whether you need an advanced corporate website, a powerful landing page, a professionnal blog or an event...

Ametys CMS 4.4.1 Cross Site Scripting

Document Title: =============== Ametys v4.4.1 CMS - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2275 Release Date: ============= 2022-01-12 Vulnerability Laboratory ID VL-ID: ==================================== 22...

Ametys v4.4.1 CMS - Cross Site Scripting Vulnerability

Document Title: =============== Ametys v4.4.1 CMS - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2275 Release Date: ============= 2022-01-12 Vulnerability Laboratory ID VL-ID: ==================================== 22...

CVE-2017-16935

Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account detail...

CVE-2017-16935

Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account detail...

Cross site request forgery (csrf)

Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account detail...

CVE-2017-16935

CVE-2017-16935 affects Ametys CMS prior to 4.0.3. The flaw arises because authentication is enforced only for URIs containing a /cms/ substring, allowing an unauthenticated attacker to bypass access restrictions by issuing a direct request to /plugins/core-ui/servercomm/messages.xml. Proof descri...

CVE-2017-16935

Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account detail...

Ametys CMS Unauthenticated Password Reset Vulnerability

Ametys CMS is prone to an unauthenticated password reset vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...