WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2012-12-31✕Vendor org.opencms✕
Overview 9 matches · 2 protected · 0 exploited · 0 CISA KEV · 4 public PoC · 0 EPSS ≥ 0.5
9matches 2protected22.2% 0exploited0.0% 0CISA KEV0.0% 4public PoC44.4% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 22.2% Rule in development 0 0.0% Mitigation candidate 3 33.3% No exploit published 4 44.4%
Critical 0 0.0% High 0 0.0% Medium 9 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 22.2% partly blocked 0 0.0% not blocked 7 77.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 4 44.4% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 55.6%
split by peak 4 / quarter
No exploit published: 4Mitigation candidate: 3Protected by Waratek: 2 Medium: 9 not blocked: 7blocked by ARMR today: 2 No public exploit: 5Working exploit published: 4
Q4 051 No exploit published1 Medium1 not blocked1 No public exploit1 Q1 060 Q2 060 Q3 063 Protected by Waratek1 No exploit published2 Medium3 blocked by ARMR today1 not blocked2 No public exploit3 Q4 060 Q1 070 Q2 070 Q3 070 Q4 070 Q1 084 Protected by Waratek1 Mitigation candidate3 Medium4 blocked by ARMR today1 not blocked3 Working exploit published4 Q2 081 No exploit published1 Medium1 not blocked1 No public exploit1
Q4 05Q1 06Q2 06Q3 06Q4 06Q1 07Q2 07Q3 07Q4 07Q1 08Q2 08
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2008-1753 Medium 2008-04-11 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in system/workplace/admin/workplace/sessions.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the searchfilter parameter, a different vector than CVE-2008-1510.
CVE-2008-1510 Medium 2008-03-25 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users_list.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the (1) searchfilter or (2) listSearchFilter parameter.
CVE-2008-1301 Medium 2008-03-12 Protected by Waratek Working exploit published Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter.
CVE-2008-1300 Medium 2008-03-12 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter in a save action, a different vector than CVE-2008-1045.
CVE-2008-1045 Medium 2008-02-27 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree_files.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the resource parameter.
CVE-2006-3936 Medium 2006-07-31 No exploit published No public exploit system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
CVE-2006-3935 Medium 2006-07-31 No exploit published No public exploit system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to (1) send broadcast messages to all users (/workplace/broadcast), (2) list all users (/accounts/users), (3) add webusers (/accounts/webusers/new), (4) upload database import and export files (/database/importhttp), (5) upload arbitrary program modules (/modules/modules_import), and (6) read the log file (/workplace/logfileview) by setting the appropriate value for the path parameter in a direct request to admin-main.jsp.
CVE-2006-3934 Medium 2006-07-31 Protected by Waratek No public exploit Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.
CVE-2005-4294 Medium 2005-12-16 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page.