Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
Ofcms ProjectOfcms

10 matches found

CVE
CVE•added 2019/03/06 10:29 p.m.•42 views

CVE-2019-9612

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/upload URI.

8.8CVSS8.9AI score0.02191EPSS
CVE
CVE•added 2019/03/06 10:29 p.m.•37 views

CVE-2019-9609

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/editUploadImage URI.

8.8CVSS8.9AI score0.02191EPSS
CVE
CVE•added 2019/03/06 10:29 p.m.•35 views

CVE-2019-9611

An issue was discovered in OFCMS before 1.1.3. It allows admin/cms/template/getTemplates.html?res_path=res directory traversal, with ../ in the dir parameter, to write arbitrary content (in the file_content parameter) into an arbitrary file (specified by the file_name parameter). This is related to...

6.5CVSS6.5AI score0.00372EPSS
CVE
CVE•added 2019/03/06 10:29 p.m.•35 views

CVE-2019-9617

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadFile URI.

8.8CVSS8.9AI score0.02191EPSS
CVE
CVE•added 2019/03/06 10:29 p.m.•34 views

CVE-2019-9613

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadVideo URI.

7.2CVSS7.3AI score0.02331EPSS
CVE
CVE•added 2019/03/06 10:29 p.m.•33 views

CVE-2019-9608

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadImage URI.

8.8CVSS8.9AI score0.02191EPSS
CVE
CVE•added 2019/03/06 10:29 p.m.•33 views

CVE-2019-9610

An issue was discovered in OFCMS before 1.1.3. It has admin/cms/template/getTemplates.html?res_path=res&up_dir=../ directory traversal, related to the getTemplates function in TemplateController.java.

4.3CVSS4.6AI score0.00126EPSS
CVE
CVE•added 2019/03/06 10:29 p.m.•33 views

CVE-2019-9614

An issue was discovered in OFCMS before 1.1.3. A command execution vulnerability exists via a template file with ' ${ ex("' followed by the command.

8.8CVSS8.6AI score0.03168EPSS
CVE
CVE•added 2019/03/06 10:29 p.m.•33 views

CVE-2019-9615

An issue was discovered in OFCMS before 1.1.3. It allows admin/system/generate/create?sql= SQL injection, related to SystemGenerateController.java.

7.2CVSS7.1AI score0.0026EPSS
CVE
CVE•added 2019/03/06 10:29 p.m.•32 views

CVE-2019-9616

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadScrawl URI.

7.2CVSS7.3AI score0.02331EPSS