CVE-2014-1613

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dcpasswd cookie to a password-protected page, which is not properly handled by 1 inc/public/lib.urlhandlers.php or 2 plugins/pages/public.php...

CVE-2014-1613

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dcpasswd cookie to a password-protected page, which is not properly handled by 1 inc/public/lib.urlhandlers.php or 2 plugins/pages/public.php...

Default credentials

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dcpasswd cookie to a password-protected page, which is not properly handled by 1 inc/public/lib.urlhandlers.php or 2 plugins/pages/public.php...

CVE-2014-1613

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dcpasswd cookie to a password-protected page, which is not properly handled by 1 inc/public/lib.urlhandlers.php or 2 plugins/pages/public.php...

CVE-2014-1613

Dotclear vulnerable before 2.6.2: a serialized object in the dc_passwd cookie can trigger remote PHP code execution via untrusted handling in inc/public/lib.urlhandlers.php or plugins/pages/_public.php. Affected: Dotclear 2.x

CVE-2014-1613

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dcpasswd cookie to a password-protected page, which is not properly handled by 1 inc/public/lib.urlhandlers.php or 2 plugins/pages/public.php...

PT-2014-4258

Name of the Vulnerable Software and Affected Versions Dotclear versions prior to 2.6.2 Description The issue allows remote attackers to execute arbitrary PHP code via a serialized object in the dc passwd cookie to a password-protected page. This is due to improper handling by certain PHP files,...

CVE-2014-1613: Improper Control of Generation of Code

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dcpasswd cookie to a password-protected page, which is not properly handled by 1 inc/public/lib.urlhandlers.php or 2 plugins/pages/public.php...

Dotclear 2.5 Cross Site Scripting

Exploit Title: Dotclear 2.5 Cms Cross Site Scripting Vulnerabilities Date: 06/04/2013 Author: Nikhalesh Singh Bhadoria Twitter: @nikhaleshsingh Download Link:http://dotclear.org/ Versions Affected: Dotclear 2.5. Category:Xss...

XSS and CS vulnerabilities in Dotclear

Hello 3APA3A! These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. CMS Dotclear has three vulnerable flash-files: swfupload.swf, playerflv.swf and playermp3.swf. File swfupload.swf it's Swfupload. I've wrote about vulnerabilities in Swfupload in November 2012...

Vulnerabilities in SWFUpload in multiple web applications: WordPress, Dotclear, InstantCMS, AionWeb and others

Hello 3APA3A! Earlier I've wrote about Content Spoofing and Cross-Site Scripting vulnerabilities in SWFUpload http://securityvulns.ru/docs29181.html. This is very popular flash-file, which is used at tens millions of web sites and in hundreds of web applications only WordPress is used at more the...

Dotclear XSS Vulnerabilities

These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. CMS Dotclear has three vulnerable flash-files: swfupload.swf, playerflv.swf and playermp3.swf. File swfupload.swf it's Swfupload. I've...

Dotclear 2.4.4 Cross Site Scripting / Content Spoofing

Hello list! These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. CMS Dotclear has three vulnerable flash-files: swfupload.swf, playerflv.swf and playermp3.swf. File swfupload.swf it's Swfupload. I've wrote about vulnerabilities in Swfupload in November 2012...

Issue with SWFUploader Could Lead to XSS Vulnerabilities, Content Spoofing

UPDATED Many versions of SWFUpload – an applet that combines Flash and JavaScript that’s used in millions of websites, including WordPress sites– are vulnerable to content spoofing and a cross-site scripting vulnerability that could lead to the takeover of accounts, according to reports this week...

XSS vulnerability in web applications with swfupload: Dotclear, XenForo, InstantCMS, AionWeb, Dolphin

Hello 3APA3A! I will draw your attention to XSS vulnerability in other web applications with swfupload. Earlier I've wrote about swfupload in WordPress CVE-2012-3414 and that this hole is available in many web applications. In previous letter I've wrote the information about different versions of...

SWF Upload Cross Site Scripting

Hello list! I will draw your attention to XSS vulnerability in other web applications with swfupload. Earlier I've wrote about swfupload in WordPress CVE-2012-3414 and that this hole is available in many web applications. In previous letter I've wrote the information about different versions of...

CVE-2012-1039

Multiple cross-site scripting XSS vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 logindata parameter to admin/auth.php; 2 nb parameter to admin/blogs.php; 3 type, 4 sortby, 5 order, or 6 status parameters to admin/comments.php; or ...

CVE-2012-1039

Multiple cross-site scripting XSS vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 logindata parameter to admin/auth.php; 2 nb parameter to admin/blogs.php; 3 type, 4 sortby, 5 order, or 6 status parameters to admin/comments.php; or ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 logindata parameter to admin/auth.php; 2 nb parameter to admin/blogs.php; 3 type, 4 sortby, 5 order, or 6 status parameters to admin/comments.php; or ...

CVE-2012-1039

Multiple cross-site scripting XSS vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 logindata parameter to admin/auth.php; 2 nb parameter to admin/blogs.php; 3 type, 4 sortby, 5 order, or 6 status parameters to admin/comments.php; or ...