CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 2CVE-2019-11819
https://notcve.org/view.php?id=CVE-2019-11819
Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name. Alkacon OpenCMS v10.5.4 y anteriores se ve afectado por la inyección CSV (también conocida como Excel Macro) en el módulo Nuevo Usuario (/opencms/system/workplace/admin/accounts/user_new.jsp) mediante el Nombre o Apellido. • https://github.com/alkacon/opencms-core/issues/636 https://www.openwall.com/lists/oss-security/2019/05/05/2 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2019-11818
https://notcve.org/view.php?id=CVE-2019-11818
Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp). This allows an attacker to insert arbitrary JavaScript as user input (First Name or Last Name), which will be executed whenever the affected snippet is loaded. Alkacon OpenCMS versión 10.5.4 y anterior, se ve afectado por los cross site scripting (XSS) almacenados en el módulo New User (/opencms/system/workplace/admin/accounts/user_new.jsp). Esto permite que un atacante introducir JavaScript arbitrario como entrada del usuario (Nombre o Apellido), que será ejecutado siempre que se cargue el fragmento de código afectado. • https://github.com/alkacon/opencms-core/issues/635 https://www.openwall.com/lists/oss-security/2019/04/30/3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 2CVE-2013-4600 – OpenCMS 8.5.1 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2013-4600
Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to system/workplace/views/admin/admin-main.jsp or the (2) requestedResource parameter to system/login/index.html. Múltiples vulnerabilidades de cross-site scripting (XSS) en Alkacon OpenCms anterior a v8.5.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro (1) “title” en system/workplace/views/admin/admin-main.jsp o en el parámetro (2) “requestedResource” en system/login/index.html OpenCMS version 8.5.1 suffers from a cross site scripting vulnerability. • http://archives.neohapsis.com/archives/bugtraq/2013-07/0113.html http://www.opencms.org/en/news/130710-opencms-v852-releasenotes.html https://github.com/alkacon/opencms-core/issues/173 https://www.htbridge.com/advisory/HTB23160 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 2CVE-2008-1300 – Alkacon OpenCMS 7.0.3 - 'logfileViewSettings.jsp?filePath' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-1300
Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter in a save action, a different vector than CVE-2008-1045. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función Logfile Viewer Settings de system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp en Alkacon OpenCms 7.0.3 y 7.0.4 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del parámetro filePath.0 en una acción save, un vector diferente a CVE-2008-1045. • https://www.exploit-db.com/exploits/31365 http://secunia.com/advisories/29278 http://securityreason.com/securityalert/3731 http://www.securityfocus.com/archive/1/489291/100/0/threaded http://www.securityfocus.com/bid/28152 https://exchange.xforce.ibmcloud.com/vulnerabilities/41095 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 1%CPEs: 2EXPL: 2CVE-2008-1301 – Alkacon OpenCMS 7.0.3 - 'logfileViewSettings.jsp?filePath.0' Arbitrary File Access
https://notcve.org/view.php?id=CVE-2008-1301
Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter. Vulnerabilidad de salto de directorio absoluto en system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp de Alkacon OpenCms 7.0.3 y 7.0.4 permite a administradores autentificados remotamente leer archivos de su elección a través de un nombre de ruta completo (pathname) en el parámetro filePath.0. • https://www.exploit-db.com/exploits/31366 http://secunia.com/advisories/29278 http://securityreason.com/securityalert/3731 http://www.securityfocus.com/archive/1/489291/100/0/threaded http://www.securityfocus.com/bid/28152 https://exchange.xforce.ibmcloud.com/vulnerabilities/41096 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •