Alkacon OpenCms XSS via query parameter in a search action

Description

References

• nvd.nist.gov/vuln/detail/CVE-2006-2571 · ADVISORY
• alkacon/opencms-core commit 9c7389a · WEB
• alkacon/opencms-core commit dd09a85 · WEB
• alkacon/opencms-core · WEB
• secunia.com/advisories/20251 · Patch
• securitytracker.com/id
• eazel.es/media/advisory002-OpenCms-Xml-Content-Demo-search-engine-Cross-site-scripting.html · Exploit
• osvdb.org/25710
• securityfocus.com/archive/1/434932/100/0/threaded
• vupen.com/english/advisories/2006/1931

Autres vulnérabilités de org.opencms:opencms-core

• CVE-2023-42346ÉLEVÉE 7.5Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.
• CVE-2023-42345MOYENNE 6.1A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.
• CVE-2023-42344ÉLEVÉE 7.3Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on …
• CVE-2023-42343MOYENNE 6.1A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
• CVE-2024-42699MOYENNE 6.5Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript pay…