CVE-2014-9017

Cross-site scripting XSS vulnerability in OpenKM before 6.4.19 build 23338 allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp...

Cross site scripting

Cross-site scripting XSS vulnerability in OpenKM before 6.4.19 build 23338 allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp...

CVE-2014-9017

OpenKM vulnerability CVE-2014-9017 is confirmed as an XSS in OpenKM before 6.4.19 (build 23338) via the Subject field in Task when accessing frontend/index.jsp. Affected product: OpenKM (document management system); root cause: unsanitized input leads to script/HTML injection. Impact stated: remo...

CVE-2014-9017

Cross-site scripting XSS vulnerability in OpenKM before 6.4.19 build 23338 allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp...

OpenKM Stored Cross Site Scripting

Exploit Title: OpenKM Platform Remote Reflected Cross Site Scripting Google Dork: N/A Date: 18-11-2014 Exploit Author: Mohamed Abdelbaset Elnoby @SymbianSyMoh Vendor Homepage: http://www.openkm.com/en / Software Link: http://www.openkm.com/en/download-english.html Version: All versions...

Openkm Document Management System 6.4.17 Cross Site Scripting

Openkm Document Management System Suffers From Cross Site Scripting Attack http://khalil-shreateh.com/khalil.shtml/images/articles/websites/vulnerabili ties/openkm.jpg Version Khalil Shreateh Auther Website: http://khalil-shreateh.com Status : Reported . Report Link :...

OpenKM Document Management System 5.1.7 Command Execution

No description provided by source. COMPASS SECURITY ADVISORY http://www.csnc.ch/ ID: COMPASS-2012-002 Product: OpenKM Document Management System 5.1.7 1 Vendor: OpenKM http://www.openkm.com/ Subject: Cross-site Request Forgery based OS Command Execution Risk: High Effect: Remotely exploitable...

CVE-2012-2315

admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authenticated users to assign administrator privileges to arbitrary users via the userEdit action...

CVE-2012-2316

Cross-site request forgery CSRF vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary code via the script parameter to admin/scripting.jsp...

Deserialization of untrusted data

admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authenticated users to assign administrator privileges to arbitrary users via the userEdit action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary code via the script parameter to admin/scripting.jsp...

CVE-2012-2315

OpenKM 5.1.7 and earlier versions (before 5.1.8-2) suffer a privilege-escillation flaw in admin/Auth: the system does not properly enforce privileges for changing user roles via the userEdit action. Remote authenticated users can assign administrator privileges to arbitrary users. Root cause: imp...

CVE-2012-2316

Cross-site request forgery CSRF vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary code via the script parameter to admin/scripting.jsp...

CVE-2012-2315

admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authenticated users to assign administrator privileges to arbitrary users via the userEdit action...

CVE-2012-2316

OpenKM 5.1.7 and earlier versions up to 5.1.8-2 are affected by a CSRF flaw in servlet/admin/AuthServlet.java. The issue allows remote attackers to hijack administrator sessions and cause arbitrary code execution via the script parameter to admin/scripting.jsp. Connected sources confirm the vulne...

OpenKM 5.1.7 - Cross-Site Request Forgery

OpenKM 5.1.7 - Cross-Site Request Forgery source: https://www.securityfocus.com/bid/53602/info OpenKM is prone to a cross-site request-forgery vulnerability. Attackers can exploit this issue to perform certain administrative actions and gain unauthorized access to the affected application. OpenKM...

OpenKM Document Management System 5.1.7 Command Execution

Exploit for jsp platform in category web applications COMPASS SECURITY ADVISORY http://www.csnc.ch/ ID: COMPASS-2012-002 Product: OpenKM Document Management System 5.1.7 1 Vendor: OpenKM http://www.openkm.com/ Subject: Cross-site Request Forgery based OS Command Execution Risk: High Effect:...

OpenKM 5.1.7 - Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/53602/info OpenKM is prone to a cross-site request-forgery vulnerability. Attackers can exploit this issue to perform certain administrative actions and gain unauthorized access to the affected application. OpenKM 5.1.7 is vulnerable; other versions may...

OpenKM 5.1.7 Privilege Escalation

COMPASS SECURITY ADVISORY http://www.csnc.ch/ ID: COMPASS-2012-001 Product: OpenKM Document Management System 5.1.7 1 Vendor: OpenKM http://www.openkm.com/ Subject: Privilege Escalation, Improper Access Control Risk: High Effect: Remotely exploitable Author: Cyrill Brunschwiler...

OpenKM 5.1.7 OS Command Execution (XSRF based)

COMPASS SECURITY ADVISORY http://www.csnc.ch/ ID: COMPASS-2012-002 Product: OpenKM Document Management System 5.1.7 1 Vendor: OpenKM http://www.openkm.com/ Subject: Cross-site Request Forgery based OS Command Execution Risk: High Effect: Remotely exploitable Author: Cyrill Brunschwiler...