CVE Vulnerability Catalog

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Stored XSS. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11.

Path Traversal vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows an attacker to access files outside the restricted directory. Affects versions from 6.7.141 before 10.0.11.

A vulnerability in OpenDMARC up to 1.4.2 affects the strcasecmp function in libopendmarc/opendmarc_policy.c, leading to improper handling of exceptional conditions. The attack can be executed remotely, and the exploit has been made public.

A vulnerability in OpenDMARC up to 1.4.2 affects the opendmarc_policy_parse_dmarc function in libopendmarc/opendmarc_policy.c. Manipulation of arguments like fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to improper handling of exceptional conditions. Remote exploitation is possible, and the exploit has been disclosed.

A flaw was found in Trusted Domain Project OpenDMARC up to 1.4.2 in unknown functionality of policy.c in the Domain Handler component. Manipulation leads to improper validation of unsafe equivalence, and the attack can be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2 in the function opendmarc_util_cleanup in libopendmarc/opendmarc_util.c of the DMARC Record Parser component. Manipulation results in an off-by-one, and the attack may be initiated remotely. The exploit is public and the patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae.

Reflected Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 occurs in the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping. The attack requires the victim to follow a crafted link, and the site must be configured with LdapCommentAuthenticator.

Stored Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows an anonymous attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it. Affects only sites with HTML in comments enabled (users.comments.htmlenabled=true) and HTMLSubset formatter.

Stored Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows an unauthenticated attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped Trackback, verification and moderation defaults allow the value to be approved and rendered as an active link; a visitor who clicks the link executes script in the weblog's origin.

Stored Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back with that type. A victim who opens the uploaded file executes the stored script. Media uploads are disabled by default; only installations that enable them are affected.

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution.

Exposure of Sensitive Information vulnerability in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath resource outside the theme namespace. Roller treats weblog administrators as untrusted and enables a Velocity sandbox, but the include and parse directives are not confined by it.

Apache Roller 6.1.5 contains a Deserialization of Untrusted Data vulnerability because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is mapped unconditionally, so parsing occurs even when the global XML-RPC feature is disabled; no non-default configuration is required. This can lead to remote code execution.

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check.

Reflected Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the directory page reflects without proper escaping. Affects only weblogs using the bundled frontpage theme, and a victim must follow a crafted link.

Stored Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding, causing the stored script to execute in another author's or administrator's browser. No optional feature or non-default configuration is required; affects weblogs with multiple authors or administrators who are not mutually trusted.

Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a value the server itself generated for the request.

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness.

Apache Roller 6.1.5 contains an Incorrect Authorization vulnerability in the OAuth 1.0a authorization endpoint. An unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer can bind that token to an arbitrary user account, including an administrator, by submitting an unsigned authorization request. The endpoint derives the authorizing identity from a request-supplied value rather than the authenticated session.

Apache Roller 6.1.5 contains a Missing Authorization vulnerability that allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs. The handlers authenticate the caller but do not verify the caller's permission on the weblog or entry actually affected. Only installations that enable the non-default global XML-RPC setting are affected; the per-weblog API flag defaults to enabled for UI-created weblogs.