Skip to content
OpenAdvisories

Package · Maven

org.opencms:opencms-core

31 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 4.3
    CVE-2019-13237 Public exploit

    Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms

    In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workp…

    org.opencms:opencms-core Maven
  • Medium 6.1
    CVE-2019-13236 Public exploit

    XSS issues in the management interface

    In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.

    org.opencms:opencms-core Maven
  • Medium 6.1
    CVE-2019-13235 Public exploit

    XSS in login form

    In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.

    org.opencms:opencms-core Maven
  • Medium 6.1
    CVE-2019-13234 Public exploit

    XSS in search engine

    In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.

    org.opencms:opencms-core Maven
  • Low —
    CVE-2008-1510 Public exploit

    Alkacon OpenCMS XSS via searchfilter or listSearchFilter parameter

    Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users_list.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the (1) searchfilter or (2) listSearchFilter parameter.

    org.opencms:opencms-core Maven
  • Medium —
    CVE-2008-1301 Public exploit

    Alkacon OpenCMS Absolute Path Traversal via pathname in filePath.0 parameter

    Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter.

    org.opencms:opencms-core Maven
  • Low —
    CVE-2008-1300 Public exploit

    Alkacon Open CMS XSS via Logfile Viewer Settings function

    Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the …

    org.opencms:opencms-core Maven
  • Low —
    CVE-2008-1045 Public exploit

    Alkacon OpenCMS XSS via file tree navigation in system/workplace/views/explorer/tree_files.jsp

    Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree_files.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the resource parameter.

    org.opencms:opencms-core Maven