CVE-2017-14850

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to improper external user-input validation. An attacker with access to the web interface is able to hijack sessions or navigate victims outside of SiteOmat, to a malicious server owned by him.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/108167Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01Third Party Advisory, US Government Resource
https://www.orpak.comVendor Advisory
http://www.securityfocus.com/bid/108167Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01Third Party Advisory, US Government Resource
https://www.orpak.comVendor Advisory

Timeline

Published: Jun 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-148519.8A SQL injection vulnerability exists in all Orpak SiteOmat versions prior to 2017-09-25. The vulnerability is in the login page, where the a CVE-2017-148528.6An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, due to an invalid SSL c CVE-2017-148538.6The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior to 2017-09-25, due to a search query that uses a d CVE-2017-148549.1A stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing for remote code execution. The vulnerability affects al CVE-2017-148558.6Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that doe CVE-2017-148575.5In Exiv2 0.26, there is an invalid free in the Image class in image.cpp that leads to a Segmentation fault. A crafted input will lead to a d CVE-2017-148585.5There is a heap-based buffer overflow in the Exiv2::l2Data function of types.cpp in Exiv2 0.26. A Crafted input will lead to a denial of ser CVE-2017-148595.5An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a CVE-2017-14866.1IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2 is vulnerable to cross-site scripting. This vulnerability allows users t CVE-2017-148605.5There is a heap-based buffer over-read in the Exiv2::Jp2Image::readMetadata function of jp2image.cpp in Exiv2 0.26. A Crafted input will lea CVE-2017-148615.5There is a stack consumption vulnerability in the Exiv2::Internal::stringFormat function of image.cpp in Exiv2 0.26. A Crafted input will le CVE-2017-148625.5An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmen