CVE-2013-3484

Multiple cross-site scripting XSS vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 loginUserName parameter to application/login/login.html, 2 myaccountlogin parameter to c/portalpublic/login, or 3 email parameter to forgotPassword...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 loginUserName parameter to application/login/login.html, 2 myaccountlogin parameter to c/portalpublic/login, or 3 email parameter to forgotPassword...

CVE-2013-3484

Multiple cross-site scripting XSS vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 loginUserName parameter to application/login/login.html, 2 myaccountlogin parameter to c/portalpublic/login, or 3 email parameter to forgotPassword...

CVE-2013-3484

DotCMS versions before 2.3.2 are affected by multiple cross-site scripting (XSS) vulnerabilities. The issue allows remote attackers to inject arbitrary web script or HTML through (1) the _loginUserName parameter in application/login/login.html, (2) the my_account_login parameter in c/portal_publi...

CVE-2012-1826

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted 1 XSLT or 2 Velocity template...

Code injection

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted 1 XSLT or 2 Velocity template...

CVE-2012-1826

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted 1 XSLT or 2 Velocity template...

CVE-2012-1826

The CVE-2012-1826 vulnerability affects dotCMS 1.9 prior to 1.9.5.1, where an authenticated user with permissions to author/upload templates can craft malicious XSLT or Velocity templates that execute arbitrary Java code on the web service account. This can lead to remote code execution and poten...

dotCMS 任意代码执行漏洞

BUGTRAQ ID: 53688 CVE ID: CVE-2012-1826 dotCMS 是一个Java开发的功能强大的内容管理系统CMS。 dotCMS 1.9.5.1和2.0.1之前版本在实现上存在任意代码执行漏洞，已经验证的dotCMS用户如果具有创建和上传模板的权限，则可创建恶意XSLT或Velocity模板以Web服务账户权限执行任意Java代码。 0 dotCMS 2.0 dotCMS 1.9.5.0 dotCMS 1.6 dotCMS 0 厂商补丁： dotCMS ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

dotCMS template permissions allow arbitrary code execution

Overview The dotCMS content management system version 1.9 and possibly earlier versions, contains a vulnerability that allows users with the appropriate permissions to create a malicious template with arbitrary code. Description An authenticated dotCMS user with the permissions required to author...

Directory traversal

Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. dot dot in the id parameter to 1 news/index.dot and 2 gettingstarted/macros/macrosdetail.dot...

CVE-2008-3708

Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. dot dot in the id parameter to 1 news/index.dot and 2 gettingstarted/macros/macrosdetail.dot...

CVE-2008-3708

DotCMS 1.6.0.9 is affected by multiple directory traversal vulnerabilities that allow remote attackers to read arbitrary files by injecting a .. in the id parameter of news/index.dot and getting_started/macros/macros_detail.dot. The root cause is insufficient input sanitization in these scripts, ...

CVE-2008-3708

Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. dot dot in the id parameter to 1 news/index.dot and 2 gettingstarted/macros/macrosdetail.dot...

dotCMS Multiple Script id Parameter Traversal Local File Inclusion

The remote host is using dotCMS, an open source J2EE / Java web content management system. The version of dotCMS installed on the remote host fails to sanitize input to the 'id' parameter of the 'news/index.dot' and 'gettingstarted/macros/macrosdetail.dot' scripts before using it to access files...

dotcms-lfi.txt

++++++++++++++++++++++++++++++++++++++++++++++++++++++ + script:dotCMS + home: http://www.dotcms.org + demo: http://www.dotcms.org/thedotcms/demos/demo.dot + founder: Don of h4cky0u.org + Vulnerability: Directory traversal ++++++++++++++++++++++++++++++++++++++++++++++++++++++ exploit:...

dotCMS 1.6 (id) Multiple Local File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications ============================================================= dotCMS 1.6 id Multiple Local File Inclusion Vulnerabilities ============================================================= ++++++++++++++++++++++++++++++++++++++++++++++++++++++ ...

dotCMS 1.6 (id) Multiple Local File Inclusion Vulnerabilities

No description provided by source. ++++++++++++++++++++++++++++++++++++++++++++++++++++++ + script:dotCMS + home: http://www.dotcms.org + demo: http://www.dotcms.org/thedotcms/demos/demo.dot + founder: Don of h4cky0u.org + Vulnerability: Directory traversal...

dotCMS 1.6 - id Local File Inclusion

dotCMS 1.6 - id Local File Inclusion ++++++++++++++++++++++++++++++++++++++++++++++++++++++ + script:dotCMS + home: http://www.dotcms.org + demo: http://www.dotcms.org/thedotcms/demos/demo.dot + founder: Don of h4cky0u.org + Vulnerability: Directory traversal...

dotCMS 1.6 - 'id' Local File Inclusion

++++++++++++++++++++++++++++++++++++++++++++++++++++++ + script:dotCMS + home: http://www.dotcms.org + demo: http://www.dotcms.org/thedotcms/demos/demo.dot + founder: Don of h4cky0u.org + Vulnerability: Directory traversal ++++++++++++++++++++++++++++++++++++++++++++++++++++++ exploit:...