PatchTheCVEonecms vulnerabilities and fixes
Recent CVEs affecting onecms, with upgrade or downgrade steps. 6 tracked.
onecms has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2011-10-07. Highest priority: CVE-2008-7209 (score 55/100).
- CVE-2010-4877 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in index.php in OneCMS 2.6.1 allows remote attackers to inject arbitr
- CVE-2010-0952 MEDIUM 6.8 DOWNGRADE SQL injection vulnerability in index.php in OneCMS 2.5, when magic_quotes_gpc is disabled, allows remote attac
- CVE-2008-7209 HIGH 7.5 UPGRADE Unrestricted file upload vulnerability in the add2 action in a_upload.php in OneCMS 2.4, and possibly earlier,
- CVE-2008-7208 MEDIUM 6.8 UPGRADE Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute
- CVE-2008-6652 HIGH 7.5 DOWNGRADE SQL injection vulnerability in asd.php in OneCMS 2.5 allows remote attackers to execute arbitrary SQL commands
- CVE-2008-2482 HIGH 7.5 DOWNGRADE Directory traversal vulnerability in install_mod.php in insanevisions OneCMS 2.5 allows remote attackers to in
FAQ
How do I fix onecms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is onecms being exploited right now?
None of the tracked onecms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which onecms CVE should I patch first?
CVE-2008-7209 currently ranks highest (55/100): Unrestricted file upload vulnerability in the add2 action in a_upload.php in OneCMS 2.4, and possibly earlier,.