dotCMS 3.2.4 CSRF / XSS / Open Redirect

dotCMS 3.2.4 Multiple Vulnerabilities Vendor: dotCMS Software, LLC Product web page: http://www.dotcms.com Affected version: 3.2.4 Enterprise Summary: DotCMS is the next generation of Content Management System CMS. Quick to deploy, open source, Java-based, open APIs, extensible and massively...

dotCMS 3.2.4 Multiple Vulnerabilities

Summary DotCMS is the next generation of Content Management System CMS. Quick to deploy, open source, Java-based, open APIs, extensible and massively scalable, dotCMS can rapidly deliver personalized, engaging multi-channel sites, web apps, campaigns, one-pagers, intranets - all types of content...

dotCMS 3.2.4 - Multiple Vulnerabilities

dotCMS 3.2.4 Multiple Vulnerabilities Vendor: dotCMS Software, LLC Product web page: http://www.dotcms.com Affected version: 3.2.4 Enterprise Summary: DotCMS is the next generation of Content Management System CMS. Quick to deploy, open source, Java-based, open APIs, extensible and massively...

dotCMS Multiple Login Page XSS Vulnerabilities (SI-14) - Active Check

dotCMS is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2013-3484

Multiple cross-site scripting XSS vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 loginUserName parameter to application/login/login.html, 2 myaccountlogin parameter to c/portalpublic/login, or 3 email parameter to forgotPassword...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 loginUserName parameter to application/login/login.html, 2 myaccountlogin parameter to c/portalpublic/login, or 3 email parameter to forgotPassword...

CVE-2013-3484

DotCMS versions before 2.3.2 are affected by multiple cross-site scripting (XSS) vulnerabilities. The issue allows remote attackers to inject arbitrary web script or HTML through (1) the _loginUserName parameter in application/login/login.html, (2) the my_account_login parameter in c/portal_publi...

CVE-2013-3484

Multiple cross-site scripting XSS vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 loginUserName parameter to application/login/login.html, 2 myaccountlogin parameter to c/portalpublic/login, or 3 email parameter to forgotPassword...

CVE-2013-3484: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 loginUserName parameter to application/login/login.html, 2 myaccountlogin parameter to c/portalpublic/login, or 3 email parameter to forgotPassword...

Code injection

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted 1 XSLT or 2 Velocity template...

CVE-2012-1826

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted 1 XSLT or 2 Velocity template...

CVE-2012-1826

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted 1 XSLT or 2 Velocity template...

CVE-2012-1826

The CVE-2012-1826 vulnerability affects dotCMS 1.9 prior to 1.9.5.1, where an authenticated user with permissions to author/upload templates can craft malicious XSLT or Velocity templates that execute arbitrary Java code on the web service account. This can lead to remote code execution and poten...

CVE-2012-1826: Undefined Security Weakness

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted 1 XSLT or 2 Velocity template...

dotCMS 任意代码执行漏洞

BUGTRAQ ID: 53688 CVE ID: CVE-2012-1826 dotCMS 是一个Java开发的功能强大的内容管理系统CMS。 dotCMS 1.9.5.1和2.0.1之前版本在实现上存在任意代码执行漏洞，已经验证的dotCMS用户如果具有创建和上传模板的权限，则可创建恶意XSLT或Velocity模板以Web服务账户权限执行任意Java代码。 0 dotCMS 2.0 dotCMS 1.9.5.0 dotCMS 1.6 dotCMS 0 厂商补丁： dotCMS ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

dotCMS template permissions allow arbitrary code execution

Overview The dotCMS content management system version 1.9 and possibly earlier versions, contains a vulnerability that allows users with the appropriate permissions to create a malicious template with arbitrary code. Description An authenticated dotCMS user with the permissions required to author...

CVE-2008-3708

Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. dot dot in the id parameter to 1 news/index.dot and 2 gettingstarted/macros/macrosdetail.dot...

Directory traversal

Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. dot dot in the id parameter to 1 news/index.dot and 2 gettingstarted/macros/macrosdetail.dot...

CVE-2008-3708

Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. dot dot in the id parameter to 1 news/index.dot and 2 gettingstarted/macros/macrosdetail.dot...

CVE-2008-3708

DotCMS 1.6.0.9 is affected by multiple directory traversal vulnerabilities that allow remote attackers to read arbitrary files by injecting a .. in the id parameter of news/index.dot and getting_started/macros/macros_detail.dot. The root cause is insufficient input sanitization in these scripts, ...