CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2019-9610
https://notcve.org/view.php?id=CVE-2019-9610
06 Mar 2019 — An issue was discovered in OFCMS before 1.1.3. It has admin/cms/template/getTemplates.html?res_path=res&up_dir=../ directory traversal, related to the getTemplates function in TemplateController.java. Se ha descubierto un problema en versiones anteriores a la 1.1.3 de OFCMS. Tiene un salto de directorio en admin/cms/template/getTemplates.html? • https://www.seebug.org/vuldb/ssvid-97838 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-9611
https://notcve.org/view.php?id=CVE-2019-9611
06 Mar 2019 — An issue was discovered in OFCMS before 1.1.3. It allows admin/cms/template/getTemplates.html?res_path=res directory traversal, with ../ in the dir parameter, to write arbitrary content (in the file_content parameter) into an arbitrary file (specified by the file_name parameter). This is related to the save function in TemplateController.java. Se ha descubierto un problema en versiones anteriores a la 1.1.3 de OFCMS. • https://www.seebug.org/vuldb/ssvid-97839 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 1CVE-2019-9612
https://notcve.org/view.php?id=CVE-2019-9612
06 Mar 2019 — An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/upload URI. Se ha descubierto un problema en versiones anteriores a la 1.1.3 de OFCMS. Los atacantes remotos pueden ejecutar código arbitrario debido a que el bloqueo de archivos .jsp y jspx no contempla (por ejemplo) file.jsp::$DATA en el URI dmin/comn/service/upload. • https://www.seebug.org/vuldb/ssvid-97835 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.2EPSS: 1%CPEs: 1EXPL: 1CVE-2019-9613
https://notcve.org/view.php?id=CVE-2019-9613
06 Mar 2019 — An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadVideo URI. Se ha descubierto un problema en versiones anteriores a la 1.1.3 de OFCMS. Los atacantes remotos pueden ejecutar código arbitrario debido a que el bloqueo de archivos .jsp y .jspx no contempla (por ejemplo) file.jsp::$DATA en el URI admin/ueditor/uploadVideo. • https://www.seebug.org/vuldb/ssvid-97834 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.2EPSS: 1%CPEs: 1EXPL: 1CVE-2019-9616
https://notcve.org/view.php?id=CVE-2019-9616
06 Mar 2019 — An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadScrawl URI. Se ha descubierto un problema en versiones anteriores a la 1.1.3 de OFCMS. Los atacantes remotos pueden ejecutar código arbitrario debido a que el bloqueo de archivos .jsp y .jspx no contempla (por ejemplo) file.jsp::$DATA en el URI admin/ueditor/uploadScrawl. • https://www.seebug.org/vuldb/ssvid-97833 • CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 1CVE-2019-9617
https://notcve.org/view.php?id=CVE-2019-9617
06 Mar 2019 — An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadFile URI. Se ha descubierto un problema en versiones anteriores a la 1.1.3 de OFCMS. Los atacantes remotos pueden ejecutar código arbitrario debido a que el bloqueo de archivos .jsp y .jspx no contempla (por ejemplo) file.jsp::$DATA en el URI admin/ueditor/uploadFile. • https://www.seebug.org/vuldb/ssvid-97831 • CWE-434: Unrestricted Upload of File with Dangerous Type •