| Max CVSS | 7.5 | Min CVSS | 3.7 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2011-1948 | 4.3 |
Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
|
13-02-2023 - 04:30 | 06-06-2011 - 19:55 | |
| CVE-2007-1462 | 4.3 |
The luci server component in conga preserves the password between page loads for the Add System/Cluster task flow by storing the password in the Value attribute of a password entry field, which allows attackers to steal the password by performing a "
|
13-02-2023 - 02:17 | 15-03-2007 - 20:19 | |
| CVE-2014-3521 | 5.5 |
The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.
|
13-02-2023 - 00:40 | 06-10-2014 - 14:55 | |
| CVE-2012-3359 | 3.7 |
Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability ty
|
13-02-2023 - 00:25 | 31-03-2014 - 14:58 | |
| CVE-2007-4136 | 5.0 |
The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections.
|
29-09-2017 - 01:29 | 14-11-2007 - 00:46 | |
| CVE-2011-0720 | 7.5 |
Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.
|
17-08-2017 - 01:33 | 03-02-2011 - 17:00 |