Alkacon OpenCms XSS via username during login

Description

References

• nvd.nist.gov/vuln/detail/CVE-2005-4294 · ADVISORY
• alkacon/opencms-core commit 148f212 · WEB
• alkacon/opencms-core · PACKAGE
• opencms.org/opencms/en/download/opencms.html · WEB
• scip.ch/cgi-bin/smss/showadvf.pl · WEB
• archives.neohapsis.com/archives/fulldisclosure/2005-12/0640.html
• secunia.com/advisories/18046 · Patch
• securitytracker.com/id
• securityfocus.com/bid/15882
• vupen.com/english/advisories/2005/2923

Mais vulnerabilidades de org.opencms:opencms-core

• CVE-2023-42346ALTO 7.5Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.
• CVE-2023-42345MÉDIO 6.1A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.
• CVE-2023-42344ALTO 7.3Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on …
• CVE-2023-42343MÉDIO 6.1A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
• CVE-2024-42699MÉDIO 6.5Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript pay…