de.eonas.portal:opencmsinstaller (8.5.1.1), de.eonas.portal:opencmsportaldriver (>=8.5.1.1, <=9.0.0.7) +12 more potentially affected by CVE-2015-2351 via org.opencms:opencms-core (8.5.1)

org.opencms:opencms-core MAVEN version 8.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - de.eonas.portal:opencmsinstaller 8.5.1.1 - de.eonas.portal:opencmsportaldriver =8.5.1.1, =9.0.0.7 -...

org.opencms.modules:com.alkacon.opencms.v8.article (>=8.0.1, <=8.0.4), org.opencms.modules:com.alkacon.opencms.v8.event (>=8.0.1, <=8.0.3) +65 more potentially affected by CVE-2015-2351 via org.opencms:opencms-core (8.0.1)

org.opencms:opencms-core MAVEN version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms.modules:com.alkacon.opencms.v8.article =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1,...

org.opencms.modules:com.alkacon.opencms.v8.event (8.5.2), org.opencms.modules:com.alkacon.opencms.v8.news (8.5.2) +31 more potentially affected by CVE-2015-2351 via org.opencms:opencms-core (8.5.2)

org.opencms:opencms-core MAVEN version 8.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms.modules:com.alkacon.opencms.v8.event 8.5.2 - org.opencms.modules:com.alkacon.opencms.v8.news 8.5.2 ...

org.opencms.modules:com.alkacon.opencms.v8.event (>=8.5.0, <=8.5.1), org.opencms.modules:com.alkacon.opencms.v8.flexible (>=8.5.0, <=8.5.1) +63 more potentially affected by CVE-2015-2351 via org.opencms:opencms-core (8.5.0)

org.opencms:opencms-core MAVEN version 8.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms.modules:com.alkacon.opencms.v8.event =8.5.0, =8.5.0, =8.5.0, =8.5.0, =8.0.2.1, =8.5.0, =8.5.0,...

org.opencms:opencms (5.0.1) potentially affected by CVE-2018-3258 via mysql:mysql-connector-java (3.0.8)

mysql:mysql-connector-java MAVEN version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on mysql:mysql-connector-java and may be impacted: - org.opencms:opencms 5.0.1 Source cves: CVE-2018-3258 Source advisory: OSV:GHSA-4VRV-CH96-6H42...

org.opencms:opencms (5.0.1) potentially affected by CVE-2017-3589 via mysql:mysql-connector-java (3.0.8)

mysql:mysql-connector-java MAVEN version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on mysql:mysql-connector-java and may be impacted: - org.opencms:opencms 5.0.1 Source cves: CVE-2017-3589 Source advisory: OSV:GHSA-CJCF-WM2P-59H5...

org.opencms:opencms (5.0.1) potentially affected by CVE-2017-3586 via mysql:mysql-connector-java (3.0.8)

mysql:mysql-connector-java MAVEN version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on mysql:mysql-connector-java and may be impacted: - org.opencms:opencms 5.0.1 Source cves: CVE-2017-3586 Source advisory: OSV:GHSA-PWH7-92H3-MQR6...

org.opencms:opencms (5.0.1) potentially affected by CVE-2017-3523 via mysql:mysql-connector-java (3.0.8)

mysql:mysql-connector-java MAVEN version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on mysql:mysql-connector-java and may be impacted: - org.opencms:opencms 5.0.1 Source cves: CVE-2017-3523 Source advisory: OSV:GHSA-2XXH-F8R3-HVVR...

Alkacon OpenCMS XSS via searchfilter parameter in system/workplace/admin/workplace/sessions.jsp

Cross-site scripting XSS vulnerability in system/workplace/admin/workplace/sessions.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the searchfilter parameter, a different vector than CVE-2008-1510...

GHSA-4R3G-W24C-GPR6 Alkacon OpenCMS XSS via searchfilter parameter in system/workplace/admin/workplace/sessions.jsp

Cross-site scripting XSS vulnerability in system/workplace/admin/workplace/sessions.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the searchfilter parameter, a different vector than CVE-2008-1510...

Alkacon OpenCMS XSS via searchfilter or listSearchFilter parameter

Cross-site scripting XSS vulnerability in system/workplace/admin/accounts/userslist.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the 1 searchfilter or 2 listSearchFilter parameter...

GHSA-4FG8-5HWC-WG5V Alkacon OpenCMS XSS via searchfilter or listSearchFilter parameter

Cross-site scripting XSS vulnerability in system/workplace/admin/accounts/userslist.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the 1 searchfilter or 2 listSearchFilter parameter...

Alkacon OpenCMS Absolute Path Traversal via pathname in filePath.0 parameter

Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter...

GHSA-XXJJ-JHGC-R68F Alkacon OpenCMS Absolute Path Traversal via pathname in filePath.0 parameter

Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter...

Alkacon OpenCMS XSS via file tree navigation in system/workplace/views/explorer/tree_files.jsp

Cross-site scripting XSS vulnerability in the file tree navigation function in system/workplace/views/explorer/treefiles.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the resource parameter...

GHSA-V965-WWRQ-GXFG Alkacon OpenCMS XSS via file tree navigation in system/workplace/views/explorer/tree_files.jsp

Cross-site scripting XSS vulnerability in the file tree navigation function in system/workplace/views/explorer/treefiles.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the resource parameter...

Alkacon OpenCMS Improper Access Control via system/workplace/views/admin/admin-main.jsp

system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to 1 send broadcast messages to all users /workplace/broadcast, 2 list all users /accounts/users, 3 add webusers...

Alkacon OpenCms Exposes JSP Source Code

system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp...

GHSA-C5VW-342H-X5RX Alkacon OpenCms Exposes JSP Source Code

system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp...

GHSA-V3C3-QR6M-8M7M Alkacon OpenCMS Improper Access Control via system/workplace/views/admin/admin-main.jsp

system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to 1 send broadcast messages to all users /workplace/broadcast, 2 list all users /accounts/users, 3 add webusers...