PT-2019-19755

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue allows remote attackers to execute arbitrary code. The blocking of .jsp and .jspx files does not consider certain file names, such as file.jsp::$DATA, which can be exploited through the...

CVE-2019-9608: Unrestricted Upload of File with Dangerous Type

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadImage URI...

PT-2019-19752

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue allows remote attackers to execute arbitrary code. The blocking of .jsp and .jspx files does not consider files with alternative data streams, such as file.jsp::$DATA, when accessing the...

CVE-2019-9612: Unrestricted Upload of File with Dangerous Type

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/comn/service/upload URI...

PT-2019-19756

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue allows remote attackers to execute arbitrary code. The blocking of .jsp and .jspx files does not consider certain file extensions, such as file.jsp::$DATA, when accessing the...

CVE-2019-9616: Use of Incorrectly-Resolved Name or Reference

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadScrawl URI...