Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
27 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, groupnew.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.
Recommended action: Upgrade to 11.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
Recommended action: Upgrade to 11.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.