Vulnerabilities

TI-2015-07926 CVE-2015-9549 · GHSA-8rv2-vrwv-jfx5

A reflected Cross-site Scripting (XSS) vulnerability exists in OcPortal 9.0.20 via the…

LOW 30

A reflected Cross-site Scripting (XSS) vulnerability exists in OcPortal 9.0.20 via the OCF_EMOTICON_CELL.tpl FIELD_NAME field to data/emoticons.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01272 Published 2020-08-03 No fix listed CWE-79

TI-2015-02362 CVE-2015-2677 · GHSA-q2mj-96fr-cgg8

Multiple cross-site scripting (XSS) vulnerabilities in ocPortal before 9.0.17 allow…

LOW 20

Multiple cross-site scripting (XSS) vulnerabilities in ocPortal before 9.0.17 allow remote authenticated users to inject arbitrary web script or HTML via the (1) title or (2) text field in the cms_calendar page to cms/in…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01508 Published 2015-03-23 No fix listed CWE-79

TI-2012-04420 CVE-2012-5234 · GHSA-f2q9-269v-j3m8

Open redirect vulnerability in index.php in ocPortal before 7.1.6 allows remote attackers…

LOW 28

Open redirect vulnerability in index.php in ocPortal before 7.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter.

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01045 Published 2012-10-01 No fix listed CWE-20

TI-2012-01293 CVE-2012-1471 · GHSA-gm2r-jhgq-w3p4

Directory traversal vulnerability in catalogue_file.php in ocPortal before 7.1.6 allows…

LOW 27

Directory traversal vulnerability in catalogue_file.php in ocPortal before 7.1.6 allows remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02008 Published 2012-10-01 No fix listed CWE-22

TI-2012-01292 CVE-2012-1470 · GHSA-4hrg-xfv8-3947

Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before…

LOW 23

Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before 7.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) line parameters.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01682 Published 2012-10-01 No fix listed CWE-79

TI-2004-01468 CVE-2004-1592 · GHSA-jw79-gm26-2pgj

PHP remote file inclusion vulnerability in index.php in ocPortal 1.0.3 and earlier allows…

LOW 38

PHP remote file inclusion vulnerability in index.php in ocPortal 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the req_path parameter to reference a URL on a remote web server that…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03053 Published 2005-02-20 No fix listed