Remote code execution

OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution RCE via XML tag injection because reportlab\platypus\paraparser.py reached via bscw.cgi op=editfolder.EditFolder calls eval on attacker-supplied Python code. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and...

PT-2021-21250

Name of the Vulnerable Software and Affected Versions OrbiTeam BSCW Classic versions prior to 5.0.12 OrbiTeam BSCW Classic versions prior to 5.1.10 OrbiTeam BSCW Classic versions prior to 5.2.4 OrbiTeam BSCW Classic versions prior to 7.3.3 OrbiTeam BSCW Classic versions prior to 7.4.3 Description...

CVE-2021-36359: XML Injection (aka Blind XPath Injection)

OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution RCE via XML tag injection because reportlab\platypus\paraparser.py reached via bscw.cgi op=editfolder.EditFolder calls eval on attacker-supplied Python code. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and...

CVE-2014-2301: Exposure of Sensitive Information to an Unauthorized Actor

OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations op=inf to an object in pub/bscw.cgi/...

PT-2014-4612

Name of the Vulnerable Software and Affected Versions OrbiTeam BSCW versions prior to 5.0.8 Description The issue allows remote attackers to obtain sensitive metadata. This is achieved by performing inf operations op=inf to an object in "pub/bscw.cgi/". Recommendations For versions prior to 5.0.8...