PT-2016-5784

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.5.1 Description The issue allows remote authenticated administrators to read arbitrary files. This is achieved by exploiting a directory traversal vulnerability in the dotTailLogServlet, specifically by using a .. do...

CVE-2016-3971: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in lucenesearch.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout...

CVE-2016-3972: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the fileName parameter...

DotCMS Cross-Site Scripting Vulnerability

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A cross-site scripting vulnerability exists in DotCMS 3.5 Beta. An attacker can exploit this vulnerability to...

DotCMS Directory Traversal Vulnerability

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A directory traversal vulnerability exists in the com.dotmarketing.servlets.taillog.TailLogServlet.class file i...

DotCMS 3.5 Beta Directory Traversal

Advisory: DotCMS Directory traversal vulnerability Author: Piaox From Pingan Product Safety Group Email: [email protected] Affected Version: dotCMS 3.5 Betathe latest version ========================== Vulnerability Description Recetly, I found a Directory traversal vulnerability in...

DotCMS 3.5 Beta Cross Site Scripting

Advisory: DotCMS xss vulnerability Author: Piaox From Pingan Product Safety Group Email: [email protected] Affected Version: dotCMS 3.5 Betathe latest version Vulnerability Description lucenesearch.jsp 26 String query = request.getParameter"query"; 27 if!UtilMethods.isSetquery 28 query ...

DotCMS SQL Injection Vulnerability

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A SQL injection vulnerability exists in DotCMS version 3.3, which originates from the...

DotCMS 3.3 SQL Injection

1¡¢Description Exploit Title: SQL Injection Vulnerability in DotCms v3.3 Date: 3-28-2016 Vendor Homepage: http://dotcms.com/ Vendor: dotcms Software: Content Management System Version: v3.3 CVE:CVE-2016-3688 2¡¢Product Summary ================ dotcms is a fully featured open source enterprise gra...

Cross-Site Scripting Vulnerability in DotCMS Blog Search Page

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A cross-site scripting vulnerability exists in DotCMS version 3.3, which originates from the blogs/ page in the...

dotCMS 3.2.4 - 多个 漏洞

No description provided by source...

dotCMS 3.2.4 CSRF / XSS / Open Redirect

dotCMS 3.2.4 Multiple Vulnerabilities Vendor: dotCMS Software, LLC Product web page: http://www.dotcms.com Affected version: 3.2.4 Enterprise Summary: DotCMS is the next generation of Content Management System CMS. Quick to deploy, open source, Java-based, open APIs, extensible and massively...

dotCMS 3.2.4 - Multiple Vulnerabilities

Exploit for php platform in category web applications dotCMS 3.2.4 Multiple Vulnerabilities Vendor: dotCMS Software, LLC Product web page: http://www.dotcms.com Affected version: 3.2.4 Enterprise Summary: DotCMS is the next generation of Content Management System CMS. Quick to deploy, open source...

dotCMS 3.2.4 - Multiple Vulnerabilities

dotCMS 3.2.4 - Multiple Vulnerabilities dotCMS 3.2.4 Multiple Vulnerabilities Vendor: dotCMS Software, LLC Product web page: http://www.dotcms.com Affected version: 3.2.4 Enterprise Summary: DotCMS is the next generation of Content Management System CMS. Quick to deploy, open source, Java-based,...

dotCMS 3.2.4 - Multiple Vulnerabilities

dotCMS 3.2.4 Multiple Vulnerabilities Vendor: dotCMS Software, LLC Product web page: http://www.dotcms.com Affected version: 3.2.4 Enterprise Summary: DotCMS is the next generation of Content Management System CMS. Quick to deploy, open source, Java-based, open APIs, extensible and massively...

dotCMS 3.2.4 Multiple Vulnerabilities

Summary DotCMS is the next generation of Content Management System CMS. Quick to deploy, open source, Java-based, open APIs, extensible and massively scalable, dotCMS can rapidly deliver personalized, engaging multi-channel sites, web apps, campaigns, one-pagers, intranets - all types of content...

dotCMS Multiple Login Page XSS Vulnerabilities (SI-14) - Active Check

dotCMS is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2013-3484

Multiple cross-site scripting XSS vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 loginUserName parameter to application/login/login.html, 2 myaccountlogin parameter to c/portalpublic/login, or 3 email parameter to forgotPassword...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 loginUserName parameter to application/login/login.html, 2 myaccountlogin parameter to c/portalpublic/login, or 3 email parameter to forgotPassword...

CVE-2013-3484

Multiple cross-site scripting XSS vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 loginUserName parameter to application/login/login.html, 2 myaccountlogin parameter to c/portalpublic/login, or 3 email parameter to forgotPassword...