opencats opencats vulnerabilities and exploits

(subscribe to this query)

4.3

CVSSv2

OpenCATS up to and including 0.9.5-3 has multiple Cross-site Scripting (XSS) issues.

Opencats Opencats

5

CVSSv2

lib/DocumentToText.php in OpenCats prior to 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format.

Opencats Opencats

3 Github repositories

10

CVSSv2

OpenCATS up to and including 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can lev...

Opencats Opencats

10

CVSSv2

OpenCATS up to and including 0.9.6 allows remote malicious users to execute arbitrary code by uploading an executable file via lib/FileUtility.php.

Opencats Opencats

1 Github repository

NA

Opencats v0.9.7 exists to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows malicious users to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title tex...

Opencats Opencats 0.9.7

NA

An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters.

Opencats Opencats 0.9.6

NA

Improper neutralization of input during web page generation allows an unauthenticated malicious user to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. This could be used...

Opencats Opencats 0.9.6

NA

Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript as the description for a calendar event, which would then be executed in other users' browsers if they browse to th...

Opencats Opencats 0.9.6

NA

Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user's session when visited.

Opencats Opencats 0.9.6

NA

OpenCATS v0.9.6 exists to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.

Opencats Opencats 0.9.6

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook