595 matches found
CVE-2016-4040: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter...
CVE-2016-3972
Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the fileName parameter...
CVE-2016-3972
Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the fileName parameter...
CVE-2016-3971
Cross-site scripting XSS vulnerability in lucenesearch.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout...
CVE-2016-3971
Cross-site scripting XSS vulnerability in lucenesearch.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout...
Cross site scripting
Cross-site scripting XSS vulnerability in lucenesearch.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout...
Directory traversal
Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the fileName parameter...
CVE-2016-3971
CVE-2016-3971 describes an XSS vulnerability in dotCMS where a crafted value in the query parameter to c/portal/layout is reflected by lucene_search.jsp. Affected product: dotCMS, versions before 3.5.1. Root cause: cross-site scripting due to improper handling of user-supplied input. Impact: pote...
CVE-2016-3971
Cross-site scripting XSS vulnerability in lucenesearch.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout...
CVE-2016-3972
dotCMS before 3.5.1 contains a directory traversal vulnerability in the dotTailLogServlet that lets remote authenticated administrators read arbitrary files via a .. in the fileName parameter. Affected component: dotTailLogServlet (dotCMS). Root cause: input traversal in fileName enables access t...
CVE-2016-3971: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in lucenesearch.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout...
CVE-2016-3972: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the fileName parameter...
DotCMS Cross-Site Scripting Vulnerability
DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A cross-site scripting vulnerability exists in DotCMS 3.5 Beta. An attacker can exploit this vulnerability to...
DotCMS Directory Traversal Vulnerability
DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A directory traversal vulnerability exists in the com.dotmarketing.servlets.taillog.TailLogServlet.class file i...
DotCMS 3.5 Beta Cross Site Scripting
Advisory: DotCMS xss vulnerability Author: Piaox From Pingan Product Safety Group Email: [email protected] Affected Version: dotCMS 3.5 Betathe latest version Vulnerability Description lucenesearch.jsp 26 String query = request.getParameter"query"; 27 if!UtilMethods.isSetquery 28 query ...
DotCMS 3.5 Beta Directory Traversal
Advisory: DotCMS Directory traversal vulnerability Author: Piaox From Pingan Product Safety Group Email: [email protected] Affected Version: dotCMS 3.5 Betathe latest version ========================== Vulnerability Description Recetly, I found a Directory traversal vulnerability in...
DotCMS SQL Injection Vulnerability
DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A SQL injection vulnerability exists in DotCMS version 3.3, which originates from the...
DotCMS 3.3 SQL Injection
1¡¢Description Exploit Title: SQL Injection Vulnerability in DotCms v3.3 Date: 3-28-2016 Vendor Homepage: http://dotcms.com/ Vendor: dotcms Software: Content Management System Version: v3.3 CVE:CVE-2016-3688 2¡¢Product Summary ================ dotcms is a fully featured open source enterprise gra...
Cross-Site Scripting Vulnerability in DotCMS Blog Search Page
DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A cross-site scripting vulnerability exists in DotCMS version 3.3, which originates from the blogs/ page in the...
