OpenCMS Unauthenticated XXE Vulnerability (CVE-2023-42344)

OpenCms is a popular open-source Java framework developed by Alkacon Software. OpenCms provides a platform for users to design and develop web applications. The latest version of the framework is 16.0. About CVE-2023-42344 CVE-2023-42344 is a critical vulnerability where users can execute code...

OpenCMS XML External Object Code Execution

The vulnerability of the OpenCMS content management system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted POST request remotely...

org.opencms:opencms (5.0.1) potentially affected by CVE-2023-22102 via mysql:mysql-connector-java (3.0.8)

mysql:mysql-connector-java MAVEN version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on mysql:mysql-connector-java and may be impacted: - org.opencms:opencms 5.0.1 Source cves: CVE-2023-22102 Source advisory: OSV:GHSA-M6VM-37G8-GQVH...

PT-2023-7554

Name of the Vulnerable Software and Affected Versions OpenCMS affected versions not specified Description The issue is related to the lack of protection for the web page structure in OpenCMS, allowing a remote attacker to conduct cross-site scripting attacks. Recommendations At the moment, there ...

PT-2023-7552

Name of the Vulnerable Software and Affected Versions OpenCMS affected versions not specified Description The issue in OpenCMS is related to the failure to neutralize special elements. This could allow a remote attacker to impact the confidentiality, integrity, and availability of information...

Cross Site Scripting (XSS)

OpenCms is vulnerable to Cross Site Scripting XSS. The vulnerability exists due to the /workplace!explorer component which allows an attacker to inject and execute arbitrary JavaScript via uploading a crafted SVG file...

GHSA-GHG2-3W9X-9599 Alkacon OpenCMS arbitrary file upload vulnerability

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

org.opencms:opencms-webapp (8.0.2) potentially affected by CVE-2023-37602 via org.opencms:opencms-core (8.0.2)

org.opencms:opencms-core MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-webapp 8.0.2 Source cves: CVE-2023-37602 Source advisory: OSV:GHSA-GHG2-3W9X-9599...

org.opencms:opencms-webapp (8.0.4) potentially affected by CVE-2023-37602 via org.opencms:opencms-core (8.0.4)

org.opencms:opencms-core MAVEN version 8.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-webapp 8.0.4 Source cves: CVE-2023-37602 Source advisory: OSV:GHSA-GHG2-3W9X-9599...

Alkacon OpenCMS arbitrary file upload vulnerability

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2023-37602

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2023-37602

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

Privilege escalation

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

PT-2023-26040

Name of the Vulnerable Software and Affected Versions Alkacon OpenCMS version 15.0 Description The issue allows attackers to execute arbitrary code via uploading a crafted PNG file, specifically exploiting an arbitrary file upload vulnerability in the component /workplace!explorer. Recommendation...

CVE-2023-37602

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2023-37602

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2023-37602: Improper Neutralization of Input During Web Page Generation

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2023-37602

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2023-37602

An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2023-37602

CVE-2023-37602 affects Alkacon OpenCMS v15.0, specifically the /workplace#!explorer component. The Arbitrary file upload vulnerability allows an attacker to upload a crafted PNG to execute arbitrary code. The NVD entry reports a CVSS v3.1 base score of 6.1 (Medium) with Network access, Low attack...