CVE-2010-4810

CVE-2010-4810 affects AR Web Content Manager (AWCM) with multiple remote file include vulnerabilities. Public details show that AWCM versions around 2.1 final (and up to 2.2 per OpenVAS) are vulnerable to RFI via theme_file parameters to includes/window_top.php and header.php, and lang_file param...

CVE-2011-1668

CVE-2011-1668 affects AR Web Content Manager (AWCM) via a cross-site scripting vulnerability in the AWCM input surface, specifically the search.php parameter. Concrete details from connected documents show AWCM versions 2.1/2.2 (and possibly others) are vulnerable to remote injection of arbitrary...

CVE-2012-2437

AWCM 2.2 contains an unauthenticated cookie forgery vulnerability in cookie_gen.php. An attacker can forge arbitrary cookies by supplying name and content parameters without authentication, as described in multiple sources (PoC shows requests like /awcm/cookie_gen.php?name=...&content=...). Root ...

CVE-2011-0903

AR Web Content Manager (AWCM) 2.2 is affected by multiple directory traversal vulnerabilities that allow reading arbitrary files via a .. in the awcm_theme or awcm_lang cookie parameters when accessing index.php or header.php. The DSquare DSquare security entry characterizes this as a Local File ...

CVE-2012-2438

AWCM 2.2 is vulnerable to an access-control flaw that lets unauthenticated attackers insert millions of comment records through the HTTP parameter com ent to show_video.php or topic.php, leading to disk consumption DoS. Root cause is lack of access protection for comment insertion. PoC examples e...