Page 3 of 15 results (0.013 seconds)

CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0

CVE-2006-3935

https://notcve.org/view.php?id=CVE-2006-3935

system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to (1) send broadcast messages to all users (/workplace/broadcast), (2) list all users (/accounts/users), (3) add webusers (/accounts/webusers/new), (4) upload database import and export files (/database/importhttp), (5) upload arbitrary program modules (/modules/modules_import), and (6) read the log file (/workplace/logfileview) by setting the appropriate value for the path parameter in a direct request to admin-main.jsp. system/workplace/views/admin/admin-main.jsp en Alkacon OpenCms before 6.2.2 no restringe el acceso a funciones de administración, lo cual permite a usuarios remotos autenticados (1) enviar mensajes de difusión a todos los usuarios (/workplace/broadcast), (2) listar todos los usuarios (/accounts/users), (3) añadir usuarios de la web (/accounts/webusers/new), (4) subir ficheros de importación y exportación de la base de datos (/database/importhttp), (5) subir módulos de programa de su elección (/modules/modules_import), y (6) leer el fichero de log (/workplace/logfileview) estableciendo el valor apropiado en parámetro path en una petición directa a admin-main.jsp. • http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt http://secunia.com/advisories/21193 http://securityreason.com/securityalert/1302 http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zip http://www.opencms.org/opencms/en/shownews.html?id=1002 http://www.securityfocus.com/archive/1/441182/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/27996 https://exchange.xforce.ibmcloud.com/vulnerabilities/28003 https://exchange.xforce.ibmcloud.com/vulnerabilities/ •

CVSS: 4.0EPSS: 0%CPEs: 6EXPL: 1

CVE-2006-3936

https://notcve.org/view.php?id=CVE-2006-3936

system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp. system/workplace/editors/editor.jsp en Alkacon OpenCms anterior a 6.2.2 permite a usuarios remotos autenticados leer el código fuente de ficheros JSP de su elección especificando el fichero en el parámetro resource, como ha sido demostrado usando index.jsp. • http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt http://secunia.com/advisories/21193 http://securityreason.com/securityalert/1302 http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zip http://www.opencms.org/opencms/en/shownews.html?id=1002 http://www.securityfocus.com/archive/1/441182/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/28001 •

CVSS: 2.6EPSS: 0%CPEs: 3EXPL: 1

CVE-2006-2571

https://notcve.org/view.php?id=CVE-2006-2571

Cross-site scripting (XSS) vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action. • http://secunia.com/advisories/20251 http://securitytracker.com/id?1016158 http://www.eazel.es/media/advisory002-OpenCms-Xml-Content-Demo-search-engine-Cross-site-scripting.html http://www.osvdb.org/25710 http://www.securityfocus.com/archive/1/434932/100/0/threaded http://www.vupen.com/english/advisories/2006/1931 •

CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2005-4475

https://notcve.org/view.php?id=CVE-2005-4475

Cross-site scripting (XSS) vulnerability in OpenCms 6.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters. • http://pridels0.blogspot.com/2005/12/opencms-xss-vuln.html http://www.osvdb.org/21877 http://www.securityfocus.com/bid/16003 •

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2005-4294

https://notcve.org/view.php?id=CVE-2005-4294

Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page. • http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0640.html http://secunia.com/advisories/18046 http://securitytracker.com/id?1015365 http://www.opencms.org/opencms/en/download/opencms.html http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1910 http://www.securityfocus.com/bid/15882 http://www.vupen.com/english/advisories/2005/2923 •