PYSEC-2022-42989

A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent up to 1.6. This issue affects the function renderCell of the file src/collective/dms/basecontent/browser/column.py. The manipulation leads to cross site scripting. The attack may be initiated...

PT-2022-27349 · Unknown · Collective.Dms.Basecontent

Name of the Vulnerable Software and Affected Versions: collective.dms.basecontent versions up to 1.6 Description: The issue affects the function renderCell of the file src/collective/dms/basecontent/browser/column.py, leading to cross site scripting. The attack may be initiated remotely...

collective.dms.basecontent 跨站脚本漏洞

collective.dms.basecontent is Collective open source a document management system for the basic content class . collective.dms.basecontent version 1.7 suffers from a cross-site scripting vulnerability. Attackers use this vulnerability to execute cross-site scripting attacks...

Siemens Desigo CC and Cerberus DMS

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Desigo CC and Cerberus DMS Vulnerability: Use of Client-Side Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to impersonate...

CVE-2022-33139

A vulnerability has been identified in Cerberus DMS All versions, Desigo CC All versions, Desigo CC Compact All versions, SIMATIC WinCC OA V3.16 All versions in default configuration, SIMATIC WinCC OA V3.17 All versions in non-default configuration, SIMATIC WinCC OA V3.18 All versions in...

CVE-2022-33139

A vulnerability has been identified in Cerberus DMS All versions, Desigo CC All versions, Desigo CC Compact All versions, SIMATIC WinCC OA V3.16 All versions in default configuration, SIMATIC WinCC OA V3.17 All versions in non-default configuration, SIMATIC WinCC OA V3.18 All versions in...

CVE-2022-33139

A vulnerability has been identified in Cerberus DMS All versions, Desigo CC All versions, Desigo CC Compact All versions, SIMATIC WinCC OA V3.16 All versions in default configuration, SIMATIC WinCC OA V3.17 All versions in non-default configuration, SIMATIC WinCC OA V3.18 All versions in...

Default configuration

A vulnerability has been identified in Cerberus DMS All versions, Desigo CC All versions, Desigo CC Compact All versions, SIMATIC WinCC OA V3.16 All versions in default configuration, SIMATIC WinCC OA V3.17 All versions in non-default configuration, SIMATIC WinCC OA V3.18 All versions in...

CVE-2022-33139

Summary: CVE-2022-33139 affects Cerberus DMS, Desigo CC/CC Compact, and SIMATIC WinCC OA (V3.16–V3.18) when only client-side authentication is used and neither server-side authentication (SSA) nor Kerberos is enabled. In this configuration, attackers could impersonate other users or exploit the c...

CVE-2022-33139

A vulnerability has been identified in Cerberus DMS All versions, Desigo CC All versions, Desigo CC Compact All versions, SIMATIC WinCC OA V3.16 All versions in default configuration, SIMATIC WinCC OA V3.17 All versions in non-default configuration, SIMATIC WinCC OA V3.18 All versions in...

PT-2022-3046 · Siemens · Simatic Wincc Oa V3.17 +4

Name of the Vulnerable Software and Affected Versions: Cerberus DMS versions all Desigo CC versions all Desigo CC Compact versions all SIMATIC WinCC OA V3.16 versions all SIMATIC WinCC OA V3.17 versions all SIMATIC WinCC OA V3.18 versions all Description: A vulnerability has been identified in th...

MAL-2022-136 Malicious code in @bmw-ispi-workplace/dms-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8225121478916753a7c4168f947d3bfcf9e5be59125debea55a95c13a362c5eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bmw-ispi-workplace/dms-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8225121478916753a7c4168f947d3bfcf9e5be59125debea55a95c13a362c5eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bmw-ispi-workplace/dms-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6898e8320468b4c586b03d0d2846a7e478816d08de35b21e51f3c6bc1d3a1324 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bmw-ispi-workplace/dms-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59ec35dcfc0b2d32da685f5d8303bb67b2568f0756ee74af7241c1a2a1d917fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-137 Malicious code in @bmw-ispi-workplace/dms-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59ec35dcfc0b2d32da685f5d8303bb67b2568f0756ee74af7241c1a2a1d917fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Dolibarr Stored Cross-site Scripting via file upload

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

GHSA-FVF9-2HJP-W936 Dolibarr Stored Cross-site Scripting via file upload

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

GHSA-F848-R5G6-6GPF Dolibarr Stored Cross-site Scripting

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

Dolibarr Stored Cross-site Scripting

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...