CVE-2016-3688

Vulnerability overview: CVE-2016-3688 is a SQL injection in dotCMS prior to version 3.5, exploitable via the c0-e3 parameter in dwr/call/plaincall/UserAjax.getUsersList.dwr. Affected software: dotCMS (CMS) prior to 3.5. Root cause / impact: Failure to properly validate the c0-e3 parameter allows ...

CVE-2016-3972

Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the fileName parameter...

CVE-2016-3972

Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the fileName parameter...

CVE-2016-3971

Cross-site scripting XSS vulnerability in lucenesearch.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout...

CVE-2016-3971

Cross-site scripting XSS vulnerability in lucenesearch.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout...

Directory traversal

Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the fileName parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in lucenesearch.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout...

CVE-2016-3971

CVE-2016-3971 describes an XSS vulnerability in dotCMS where a crafted value in the query parameter to c/portal/layout is reflected by lucene_search.jsp. Affected product: dotCMS, versions before 3.5.1. Root cause: cross-site scripting due to improper handling of user-supplied input. Impact: pote...

CVE-2016-3971

Cross-site scripting XSS vulnerability in lucenesearch.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout...

CVE-2016-3972

dotCMS before 3.5.1 contains a directory traversal vulnerability in the dotTailLogServlet that lets remote authenticated administrators read arbitrary files via a .. in the fileName parameter. Affected component: dotTailLogServlet (dotCMS). Root cause: input traversal in fileName enables access t...

DotCMS Cross-Site Scripting Vulnerability

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A cross-site scripting vulnerability exists in DotCMS 3.5 Beta. An attacker can exploit this vulnerability to...

DotCMS Directory Traversal Vulnerability

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A directory traversal vulnerability exists in the com.dotmarketing.servlets.taillog.TailLogServlet.class file i...

DotCMS 3.5 Beta Cross Site Scripting

Advisory: DotCMS xss vulnerability Author: Piaox From Pingan Product Safety Group Email: [email protected] Affected Version: dotCMS 3.5 Betathe latest version Vulnerability Description lucenesearch.jsp 26 String query = request.getParameter"query"; 27 if!UtilMethods.isSetquery 28 query ...

DotCMS 3.5 Beta Directory Traversal

Advisory: DotCMS Directory traversal vulnerability Author: Piaox From Pingan Product Safety Group Email: [email protected] Affected Version: dotCMS 3.5 Betathe latest version ========================== Vulnerability Description Recetly, I found a Directory traversal vulnerability in...

DotCMS SQL Injection Vulnerability

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A SQL injection vulnerability exists in DotCMS version 3.3, which originates from the...

DotCMS 3.3 SQL Injection

1¡¢Description Exploit Title: SQL Injection Vulnerability in DotCms v3.3 Date: 3-28-2016 Vendor Homepage: http://dotcms.com/ Vendor: dotcms Software: Content Management System Version: v3.3 CVE:CVE-2016-3688 2¡¢Product Summary ================ dotcms is a fully featured open source enterprise gra...

Cross-Site Scripting Vulnerability in DotCMS Blog Search Page

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A cross-site scripting vulnerability exists in DotCMS version 3.3, which originates from the blogs/ page in the...

dotCMS 3.2.4 - 多个 漏洞

No description provided by source...

dotCMS 3.2.4 - Multiple Vulnerabilities

dotCMS 3.2.4 - Multiple Vulnerabilities dotCMS 3.2.4 Multiple Vulnerabilities Vendor: dotCMS Software, LLC Product web page: http://www.dotcms.com Affected version: 3.2.4 Enterprise Summary: DotCMS is the next generation of Content Management System CMS. Quick to deploy, open source, Java-based,...

dotCMS 3.2.4 - Multiple Vulnerabilities

Exploit for php platform in category web applications dotCMS 3.2.4 Multiple Vulnerabilities Vendor: dotCMS Software, LLC Product web page: http://www.dotcms.com Affected version: 3.2.4 Enterprise Summary: DotCMS is the next generation of Content Management System CMS. Quick to deploy, open source...