CVE-2006-3935

MEDIUM Year: 2006
CVSS v2 Score
6.5
Medium
Weakness Type
NVD-CWE-Other
View all →

Vulnerability Description

system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to (1) send broadcast messages to all users (/workplace/broadcast), (2) list all users (/accounts/users), (3) add webusers (/accounts/webusers/new), (4) upload database import and export files (/database/importhttp), (5) upload arbitrary program modules (/modules/modules_import), and (6) read the log file (/workplace/logfileview) by setting the appropriate value for the path parameter in a direct request to admin-main.jsp.

Related Vulnerabilities

CVE-2016-8284

LOW
CVSS:1.8(Low)

Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows local users to affect availability via vectors related to Server: Replication.

NVD-CWE-Other2016

CVE-2017-10122

LOW
CVSS:1.8(Low)

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows high p...

NVD-CWE-Other2017

CVE-2018-3270

LOW
CVSS:1.8(Low)

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows high privi...

NVD-CWE-Other2018

CVE-2019-3008

LOW
CVSS:1.8(Low)

Vulnerability in the Oracle Solaris product of Oracle Systems (component: LDAP Library). The supported version that is affected is 11. Difficult to exploit vulnerability allows high privileged attacke...

NVD-CWE-Other2019

CVE-2021-2147

LOW
CVSS:1.8(Low)

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Installation). The supported version that is affected is 8.8. Difficult to exploit vulnerability allows high...

NVD-CWE-Other2021

CVE-2021-35618

LOW
CVSS:1.8(Low)

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high priv...

NVD-CWE-Other2021