CVE-2022-24789 Deserialization of untrusted data in C1 CMS.

C1 CMS is an open-source, .NET based Content Management System CMS. Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery SSRF by causing the server to make arbitrary GET requests to other servers in the local network or on localhost. The attacker may also...

CVE-2022-24789

C1 CMS vulnerability CVE-2022-24789 affects the .NET-based C1 CMS before version 6.12. An authenticated user can trigger SSRF, causing the server to issue arbitrary GET requests to internal/local network resources, and may also truncate files to zero size, leading to DoS or logic alteration. Root...

CVE-2022-24789 Deserialization of untrusted data in C1 CMS.

C1 CMS is an open-source, .NET based Content Management System CMS. Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery SSRF by causing the server to make arbitrary GET requests to other servers in the local network or on localhost. The attacker may also...

Orckestra C1 CMS 代码问题漏洞

Orckestra C1 CMS is an open source web content management system CMS based on . A code issue vulnerability exists in Orckestra C1 CMS versions prior to 6.12 that allows an authenticated attacker to send arbitrary GET requests through the server to other servers on the local network or localhost...

CVE-2021-34992

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10. Authentication is required to exploit this vulnerability. The specific flaw exists within Composite.dll. The issue results from the lack of proper validation of user-supplied...

CVE-2021-34992

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10. Authentication is required to exploit this vulnerability. The specific flaw exists within Composite.dll. The issue results from the lack of proper validation of user-supplied...

Deserialization of untrusted data

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10. Authentication is required to exploit this vulnerability. The specific flaw exists within Composite.dll. The issue results from the lack of proper validation of user-supplied...

CVE-2021-34992

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10. Authentication is required to exploit this vulnerability. The specific flaw exists within Composite.dll. The issue results from the lack of proper validation of user-supplied...

CVE-2021-34992

CVE-2021-34992 affects Orckestra C1 CMS 6.10 with the vulnerability in Composite.dll where improper validation leads to deserialization of untrusted data and remote code execution in the service account context. Exploitation requires authentication; ZDI-14740 is cited. Red Hat/NVD/OSV references ...

Orckestra C1 CMS Composite Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The specific flaw exists within Composite.dll. The issue results from the lack of proper validation of user-supplied data,...

Orckestra C1 CMS Code Execution Vulnerability

Orckestra C1 CMS is an open source web content management system CMS based on . A security vulnerability exists in the EntityTokenSerializer class of the Composite.dll file in Orckestra C1 CMS 6.6 and earlier versions. An attacker can exploit the vulnerability to execute code...

CVE-2019-18211

An issue was discovered in Orckestra C1 CMS through 6.6. The EntityTokenSerializer class in Composite.dll is prone to unvalidated deserialization of wrapped BinaryFormatter payloads, leading to arbitrary remote code execution for any low-privilege user...

CVE-2019-18211

An issue was discovered in Orckestra C1 CMS through 6.6. The EntityTokenSerializer class in Composite.dll is prone to unvalidated deserialization of wrapped BinaryFormatter payloads, leading to arbitrary remote code execution for any low-privilege user...

Deserialization of untrusted data

An issue was discovered in Orckestra C1 CMS through 6.6. The EntityTokenSerializer class in Composite.dll is prone to unvalidated deserialization of wrapped BinaryFormatter payloads, leading to arbitrary remote code execution for any low-privilege user...

CVE-2019-18211

Orckestra C1 CMS (up to version 6.6) is affected. The vulnerability lies in the EntityTokenSerializer class (Composite.dll), which allows unvalidated deserialization of wrapped BinaryFormatter payloads, enabling arbitrary remote code execution for any low-privilege user. Documents consistently de...

CVE-2019-18211

An issue was discovered in Orckestra C1 CMS through 6.6. The EntityTokenSerializer class in Composite.dll is prone to unvalidated deserialization of wrapped BinaryFormatter payloads, leading to arbitrary remote code execution for any low-privilege user...