WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor alkacon✕
Overview 12 matches · 9 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
12matches 9in Waratek scope75.0% 2protected16.7% 0exploited0.0% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 16.7% Rule in development 0 0.0% Mitigation candidate 7 58.3% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 3 25.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 1 8.3% Medium 11 91.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 16.7% partly blocked 0 0.0% not blocked 10 83.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 12 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 4 / year
Not applicable: 3Mitigation candidate: 7Protected by Waratek: 2 Medium: 11High: 1 not blocked: 10blocked by ARMR today: 2 Working exploit published: 12
20084 Protected by Waratek1 Mitigation candidate3 Medium4 blocked by ARMR today1 not blocked3 Working exploit published4 20090 20100 20110 20120 20130 20140 20150 20160 20170 20182 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20194 Protected by Waratek1 Mitigation candidate3 Medium4 blocked by ARMR today1 not blocked3 Working exploit published4 20200 20210 20220 20232 Mitigation candidate1 Not applicable1 Medium2 not blocked2 Working exploit published2
20092011201320152017201920212023
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-6380 Medium 2023-12-13 Not applicable Working exploit published Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability is possible due to the fact that there is no proper sanitization of the 'URI' parameter.
CVE-2023-6379 Medium 2023-12-13 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially take control of their browsing session.
CVE-2019-13237 Medium 2019-08-27 Protected by Waratek Working exploit published In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.
CVE-2019-13236 Medium 2019-08-27 Mitigation candidate Working exploit published In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.
CVE-2019-13235 Medium 2019-08-27 Mitigation candidate Working exploit published In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
CVE-2019-13234 Medium 2019-08-27 Mitigation candidate Working exploit published In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
CVE-2018-8815 Medium 2018-03-20 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image.
CVE-2018-8811 High 2018-03-20 Not applicable Working exploit published Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. Note: It is argued that OpenCMS allows only registered users to upload different kind of content artifacts (SVG, .doc, .docx). The uploaded content is stored in the CMS content repository "as is". In case of scripts inside an SVG, this may or may not be "malicious", there is no way of knowing if the uploaded SVG contains the script for a reason. To exploit the "issue", a user must have an account in the CMS as a content manager
CVE-2008-1510 Medium 2008-03-25 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users_list.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the (1) searchfilter or (2) listSearchFilter parameter.
CVE-2008-1301 Medium 2008-03-12 Protected by Waratek Working exploit published Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter.
CVE-2008-1300 Medium 2008-03-12 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter in a save action, a different vector than CVE-2008-1045.
CVE-2008-1045 Medium 2008-02-27 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree_files.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the resource parameter.