11 results (0.005 seconds)

CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 2

CVE-2020-8778 – Alfresco 5.2.4 - Persistent Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2020-8778

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project. Alfresco Enterprise versiones anteriores a 5.2.7 y Alfresco Community versiones anteriores a 6.2.0 (rb65251d6-b368), presentan una vulnerabilidad de tipo XSS por medio de un documento cargado, cuando el atacante posee acceso de escritura a un proyecto. Alfresco version 5.2.4 suffers from multiple persistent cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/48162 http://packetstormsecurity.com/files/156599/Alfresco-5.2.4-Cross-Site-Scripting.html https://gitlab.com/snippets/1937042 https://issues.alfresco.com/jira/browse/ALF-22110 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 2

CVE-2020-8777 – Alfresco 5.2.4 - Persistent Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2020-8777

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document. Alfresco Enterprise versiones anteriores a.2.7 y Alfresco Community versiones anteriores a 6.2.0 (rb65251d6-b368), presentan una vulnerabilidad de tipo XSS por medio de una foto de perfil de usuario, como es demostrado por medio de un elemento SCRIPT en un documento SVG. Alfresco version 5.2.4 suffers from multiple persistent cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/48162 http://packetstormsecurity.com/files/156599/Alfresco-5.2.4-Cross-Site-Scripting.html https://gitlab.com/snippets/1937042 https://issues.alfresco.com/jira/browse/ALF-22110 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 2

CVE-2020-8776 – Alfresco 5.2.4 - Persistent Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2020-8776

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file. Alfresco Enterprise versiones anteriores a.2.7 y Alfresco Community versiones anteriores a 6.2.0 (rb65251d6-b368), presentan una vulnerabilidad de tipo XSS por medio de la propiedad URL de un archivo. Alfresco version 5.2.4 suffers from multiple persistent cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/48162 http://packetstormsecurity.com/files/156599/Alfresco-5.2.4-Cross-Site-Scripting.html https://gitlab.com/snippets/1937042 https://issues.alfresco.com/jira/browse/ALF-22110 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1

CVE-2019-19496

https://notcve.org/view.php?id=CVE-2019-19496

Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document. Alfresco Enterprise en versiones anteriores a la 5.2.5 permite un ataque de tipo XSS almacenado mediante un documento HTML cargado. • https://github.com/vipinxsec/Alfresco_XSS/blob/master/README.md https://vipinxsec.blogspot.com/2019/11/alfresco-stored-xss-vulnerability-blind.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1

CVE-2019-14223

https://notcve.org/view.php?id=CVE-2019-14223

An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted POST request. By manipulating the POST parameters, an attacker can redirect a victim to a malicious website over any protocol the attacker desires (e.g.,http, https, ftp, smb, etc.). Se descubrió un problema en Alfresco Community Edition versiones inferiores a 5.2.6, 6.0.N y 6.1.N. • https://community.alfresco.com/content?filterID=all~objecttype~thread%5Bquestions%5D https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14223-Open%20Redirect%20in%20Alfresco%20Share-Alfresco%20Community • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •