[MajorSecurity #11]OpenCMS<= 6.2.1 - XSS

MajorSecurity 11OpenCMS= 6.2.1 - XSS ------------------------------------------ Software: OpenCMS Version: =6.2.1 Type: Cross site scripting Date: June, 10th 2006 Vendor: Alkacon Software GmbH Page: http://www.alkacon.com http://www.opencms.org/opencms/en/ Credits: ----------------------------...

OpenCms version 6.0.x Xml Content Demo search engine Cross site scripting

Version: Tested on: - 6.0.0 - 6.0.2 - 6.0.3 Discovered by: jaime.blascoateazeldot.es http://www.eazel.es Description: Input passed to the search query in the Xml Content Demo search engine isn't properly sanitised. This can be exploited to conduct cross-site scripting attacks. Example:...

Cross site scripting

Cross-site scripting XSS vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action...

CVE-2006-2571

Cross-site scripting XSS vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action...

CVE-2006-2571

Cross-site scripting XSS vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action...

CVE-2006-2571

The CVE-2006-2571 entry refers to an XSS vulnerability in Alkacon OpenCms (versions 6.0.0, 6.0.2, 6.0.3) where arbitrary web script/HTML can be injected through the query parameter in a search action on search.html. This is triggered remotely via the vulnerable search feature, enabling script exe...

CVE-2006-2571: Undefined Security Weakness

Cross-site scripting XSS vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action...

CVE-2005-4475

Cross-site scripting XSS vulnerability in OpenCms 6.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters...

CVE-2005-4475

OpenCms 6.0.3 and earlier is affected by a Cross-site Scripting (XSS) vulnerability in unspecified search parameters. Root cause: improper handling of user-supplied search inputs leading to script/HTML injection. Impact (per provided data): partial confidentiality, integrity, and availability. No...

CVE-2005-4475

Cross-site scripting XSS vulnerability in OpenCms 6.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters...

CVE-2005-4475: Undefined Security Weakness

Cross-site scripting XSS vulnerability in OpenCms 6.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters...

OpenCms XSS vuln.

OpenCms XSS vuln. Vuln. discovered by : r0t Date: 21 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/opencms-xss-vuln.html vendor:http://www.opencms.org/ affected version:6.0.3 and prior Product Description: OpenCms is a professional level Open Source Website Content Management...

CVE-2005-4294

Cross-site scripting XSS vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page...

CVE-2005-4294

Alkacon OpenCms

CVE-2005-4294

Cross-site scripting XSS vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page...

[Full-disclosure] [scip_Advisory 1910] Alkacon OpenCms 6.0.2 login Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alkacon OpenCms 6.0.2 login Cross Site Scripting scip AG Vulnerability Advisory ID 1910 11/22/2005 http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1910 I. INTRODUCTION Alkacon OpenCms is a professional level open source website content management syste...

CVE-2005-4294: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page...